Making a new app, why do I get no search results when I run a search with join and a subsearch?

[_dave_b]

I am trying to make a new App to see if I can get dashboard visualizations to work by duplicating the conditions they work under in the Splunk 6.x Dashboard Examples app, but I am not getting any results back from my search when I do a join & subsearch. This is strange, because the same search returns results in the Search app. Are there any common causes for things like this to happen? Was there a special step I was supposed to take in making my app?

[sundareshr]

subsearches have limitations, run duration as well as max records. Look at the events returned in the job activity list. That should give you some clues.

[stephanefotso]

Hello. Please let see the search query you are using.

[jkat54 · Accepted solution]

You would benefit if you read up on knowledge objects and application development first.

It sounds like you have "search time field extraction" in a props.conf and/or transforms.conf in your search app that does not exist in your new app. You may be extracting a field called foo in your search app's props.conf... and then writing the search using the field called foo in your search app... and then finding the field doesnt exist in your new app because your new app doesnt have the same props.conf, etc.

Start here: http://docs.splunk.com/Documentation/Splunk/6.1/admin/Wheretofindtheconfigurationfiles

http://docs.splunk.com/Documentation/Splunk/6.3.1/admin/Propsconf <-search & index time field extractions

http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Transformsconf <-search & ???index??? (dont quote me) time field extractions

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Createandmaintainsearch-timefieldextract... <-search time field extractions howto

Another explanation is that you dont have permissions on the extractions that exist in the newly developed app, in which case you should review local & default meta configs:

http://docs.splunk.com/Documentation/Splunk/6.3.1/admin/Defaultmetaconf

[_dave_b]

Thanks! So I could get something working quickly, I decided to modify the example dashboard in the simple-xml examples app. I ran into the same problem, where the joined subsearch brought back some results, but only when searching for certain values, but not the one I'm interested in. After reviewing the local config files props.conf and comparing it against my working copy in the Search app, I noticed the its props.conf file didn't contain a line for the extraction of the field (a device ID) that I was using to join the subsearch to the main search.

I could see all the fields were being extracted in the main search, so I assumed they would also be extracted for the subsearch as well, and there would be no need to define my extractions and fields all over again. But I did, and now the subsearch works, so it looks like it made all the difference between a functioning and non-functioning search.

[jkat54]

Thanks for accepting the answer. Im glad you found your needle in the haystack.

YOu might be interested in this command:

./splunk cmd btool props list --debug

also

./splunk cmd btool [configFileName] list --debug

[jkat54]

You might also be interested in seeing extractions, transformations and such in your GUI.

http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Managefieldtransforms

settings -> fields -> .... many options to know and choose ...