Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Getting Data In
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- No results in search
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
patilsh
Explorer
06-13-2017
01:35 PM
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
newbie2tech
Communicator
06-13-2017
01:48 PM
your query looks correct, try giving space between |and stats command , also make sure the eventData.farTalk and callid are showing up in the interesting fileds when you look at raw events and that their spelling is correct.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
newbie2tech
Communicator
06-13-2017
01:48 PM
your query looks correct, try giving space between |and stats command , also make sure the eventData.farTalk and callid are showing up in the interesting fileds when you look at raw events and that their spelling is correct.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MuS
Legend
06-13-2017
01:46 PM
Quick check, do you have the fields eventData.farTalk and callid available? Also check the names of the fields since they are case sensitive.
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
patilsh
Explorer
06-13-2017
01:49 PM
Thanks, that helped!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MuS
Legend
06-13-2017
01:51 PM
So did it solve your problem already?
Related Topics
Get Updates on the Splunk Community!
Cultivate Your Career Growth with Fresh Splunk Training
Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...
Introducing a Smarter Way to Discover Apps on Splunkbase
We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.
Because we’ve ...
How to Send Splunk Observability Alerts to Webex teams in Minutes
As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...
