All Apps and Add-ons

Making a new app, why do I get no search results when I run a search with join and a subsearch?

_dave_b
Communicator

I am trying to make a new App to see if I can get dashboard visualizations to work by duplicating the conditions they work under in the Splunk 6.x Dashboard Examples app, but I am not getting any results back from my search when I do a join & subsearch. This is strange, because the same search returns results in the Search app. Are there any common causes for things like this to happen? Was there a special step I was supposed to take in making my app?

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

You would benefit if you read up on knowledge objects and application development first.

It sounds like you have "search time field extraction" in a props.conf and/or transforms.conf in your search app that does not exist in your new app. You may be extracting a field called foo in your search app's props.conf... and then writing the search using the field called foo in your search app... and then finding the field doesnt exist in your new app because your new app doesnt have the same props.conf, etc.

Start here: http://docs.splunk.com/Documentation/Splunk/6.1/admin/Wheretofindtheconfigurationfiles

http://docs.splunk.com/Documentation/Splunk/6.3.1/admin/Propsconf <-search & index time field extractions

http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Transformsconf <-search & ???index??? (dont quote me) time field extractions

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Createandmaintainsearch-timefieldextract... <-search time field extractions howto

Another explanation is that you dont have permissions on the extractions that exist in the newly developed app, in which case you should review local & default meta configs:

http://docs.splunk.com/Documentation/Splunk/6.3.1/admin/Defaultmetaconf

View solution in original post

sundareshr
Legend

subsearches have limitations, run duration as well as max records. Look at the events returned in the job activity list. That should give you some clues.

0 Karma

stephanefotso
Motivator

Hello. Please let see the search query you are using.

0 Karma

jkat54
SplunkTrust
SplunkTrust

You would benefit if you read up on knowledge objects and application development first.

It sounds like you have "search time field extraction" in a props.conf and/or transforms.conf in your search app that does not exist in your new app. You may be extracting a field called foo in your search app's props.conf... and then writing the search using the field called foo in your search app... and then finding the field doesnt exist in your new app because your new app doesnt have the same props.conf, etc.

Start here: http://docs.splunk.com/Documentation/Splunk/6.1/admin/Wheretofindtheconfigurationfiles

http://docs.splunk.com/Documentation/Splunk/6.3.1/admin/Propsconf <-search & index time field extractions

http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Transformsconf <-search & ???index??? (dont quote me) time field extractions

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Createandmaintainsearch-timefieldextract... <-search time field extractions howto

Another explanation is that you dont have permissions on the extractions that exist in the newly developed app, in which case you should review local & default meta configs:

http://docs.splunk.com/Documentation/Splunk/6.3.1/admin/Defaultmetaconf

_dave_b
Communicator

Thanks! So I could get something working quickly, I decided to modify the example dashboard in the simple-xml examples app. I ran into the same problem, where the joined subsearch brought back some results, but only when searching for certain values, but not the one I'm interested in. After reviewing the local config files props.conf and comparing it against my working copy in the Search app, I noticed the its props.conf file didn't contain a line for the extraction of the field (a device ID) that I was using to join the subsearch to the main search.

I could see all the fields were being extracted in the main search, so I assumed they would also be extracted for the subsearch as well, and there would be no need to define my extractions and fields all over again. But I did, and now the subsearch works, so it looks like it made all the difference between a functioning and non-functioning search.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Thanks for accepting the answer. Im glad you found your needle in the haystack.

YOu might be interested in this command:

./splunk cmd btool props list --debug

also

./splunk cmd btool [configFileName] list --debug

0 Karma

jkat54
SplunkTrust
SplunkTrust

You might also be interested in seeing extractions, transformations and such in your GUI.

http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Managefieldtransforms

settings -> fields -> .... many options to know and choose ...

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...