Archive
Highlighted

Contingency: no results found

New Member

I have two fields: EventCode (66 distinct values) and date_mday (28 distinct values)

But when I run:

' * | contingency EventCode date_mday '

On over 1.2M events I get no results. What am I doing wrong?
Thanks

Also, suggestion: If a field is mistyped, show it in red if it doesn't exist.

Tags (1)
0 Karma
Highlighted

Re: Contingency: no results found

SplunkTrust
SplunkTrust

Could you try to give proper index/sourcetype name instead of using *??

0 Karma
Highlighted

Re: Contingency: no results found

Path Finder

If those are indeed valid fields in the search, I'd look at the time frame. Make sure those events did occur during the selected time frame.

0 Karma
Highlighted

Re: Contingency: no results found

New Member

I used * just to make sure I was looking at the entire event set in case I was missing something. When I changed contingency to ctable (and changed nothing else), I get the table I expected. Interesting. Thanks for your reply.

0 Karma