Getting Data In

No results in search

Explorer

deleted

Tags (1)
0 Karma
1 Solution

Communicator

your query looks correct, try giving space between |and stats command , also make sure the eventData.farTalk and callid are showing up in the interesting fileds when you look at raw events and that their spelling is correct.

View solution in original post

0 Karma

Communicator

your query looks correct, try giving space between |and stats command , also make sure the eventData.farTalk and callid are showing up in the interesting fileds when you look at raw events and that their spelling is correct.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Quick check, do you have the fields eventData.farTalk and callid available? Also check the names of the fields since they are case sensitive.

cheers, MuS

0 Karma

Explorer

Thanks, that helped!!!

0 Karma

SplunkTrust
SplunkTrust

So did it solve your problem already?

0 Karma