Queries not giving exact result

[sunnyparmar]

Hi,

My queries is something like given below -

index=abc sourcetype=xyz ERROR | rename ERROR as "Error message" | timechart span=1h count by "Error message"

but it is not giving the exact result when its running. I want to see the column "error message" with the time frame but it's giving me the column "null" with the time frame. Any suggestions would be appreciated. Thanks

In the 2nd query -

index=abc sourcetype=xyz upload_log_message="ERROR*" | rename upload_log_message as "Error message" | top "Error message"

Through this query i want to see the top error messages that is showing in 1st query. this query is returning "no result found". How it could be possible when from 1st query i am able to fetching the error logs. Any ideas for this?

Thanks

[woodcock]

Although you are selecting events with the string "error", you are not creating a field called ERROR so splunk is using null to indicate this. You need to use the rex command (before the stats command) to create this field and then it will work.