Why won't Splunk stats search not display data?

[SS1]

Hi,

I have below search, i have clubbed 3 searches into 1. Each individual search is working fine but when i clubbed its not able to pull data from previous year and the table shows empty values fore few months

index=dev  AND "alpha" | dedup _time|  eval Month=strftime(_time,"%m %b %Y")|stats count by Month| rename count as alpha | appendcols [search index=DEV AND "[beta]" | dedup _time|eval Month=strftime(_time,"%m %b %Y")|stats count by Month| rename count as beta] | appendcols [search index=dev AND "gamma"  | dedup _time| eval Month=strftime(_time,"%m %b %Y")|stats count by Month| rename count as gamma]

[SS1]

Hi @ITWhisperer 

Thanks for the response, my events will have "alpha" or "gamma" or gamma [beta], how would the search be like?

[ITWhisperer]

Case function operates left to right, so check gamma [beta] before gamma

[ITWhisperer]

appendcols is rarely the right answer

If your events only have either "alpha" or "[beta]" or "gamma" and never more than one of them, you could try something like this

index=dev
| eval type=case(match(_raw,"alpha"),"alpha",match(_raw,"\[beta\]"),"beta",match(_raw,"gamma"),"gamma")
| dedup _time type
| eval Month=strftime(_time,"%m %b %Y")
| chart count by Month type