Getting Data In
Highlighted

missing sourcetype in index summary

Explorer

I have two summary reports over an index, and one sourcetype is missing from one.

The reports are:
index="esam"
| eval fred=sourcetype.":".host
| eval time=strftime(time,"%Y-%m-%d")
| stats count BY time, fred
| xyseries time, fred, count
and:
index="esam"
| eval date=strftime( _time, "%Y-%m-%d" ), channel=COALESCE(channel,' ')
| stats min(
time) AS mintime, max(time) AS maxtime, count BY sourcetype, date, channel, host
| fieldformat min
time=strftime(mintime, "%Y-%m-%d %H:%M:%S.%3N")
| fieldformat max
time=strftime(max_time, "%Y-%m-%d %H:%M:%S.%3N")

one sourcetype is present in the results of the first report and missing from the second.

Can you advise where to look for the problem?

Tags (2)
0 Karma
Highlighted

Re: missing sourcetype in index summary

SplunkTrust
SplunkTrust

Are you running over the same timerange?

0 Karma
Highlighted

Re: missing sourcetype in index summary

Explorer

Yes. -7d@d -> now
the logs (each sourcetype is a different set of log files) are all over the same timeperiod.

0 Karma
Highlighted

Re: missing sourcetype in index summary

SplunkTrust
SplunkTrust

most likely, there is a record with a sourcetype and no host. Update the second line of the second search to ...

 | eval date=strftime( _time, "%Y-%m-%d" ), channel=COALESCE(channel,' '), host=coalesce(host,"((missing))")
0 Karma
Highlighted

Re: missing sourcetype in index summary

Explorer

Thanks. I tried that. No change.

|time|ESAM:AT_messages:main|ESAM:break_decisioning:main|ESAM:break_evaluation:main|ESAM:break_return:main|ESAM:esam_server_debug:main|ESAM:scte104_splice_request_messages:main|ESAM:vicc_polling:main|ESAM:vicc_sanity_check:main|
|2018-06-05|7615438|18|27|16|3029470|11|57495|46|

and

|sourcetype|date|channel|host|min_time|max_time|count|
|ESAM:break_decisioning|2018-06-05|AD2|main|2018-06-05 08:43:50.641|2018-06-05 16:10:24.016|18|
|ESAM:break_evaluation|2018-06-05|AD2|main|2018-06-05 08:43:50.294|2018-06-05 16:10:13.902|27|
|ESAM:break_return|2018-06-05|AD2|main|2018-06-05 08:52:43.124|2018-06-05 16:12:00.352|16|
|ESAM:scte104_splice_request_messages|2018-06-05|AD2|main|2018-06-05 08:51:06.782|2018-06-05 16:10:24.016|11|
|ESAM:vicc_polling|2018-06-05|AD2|main|2018-06-05 00:00:02.328|2018-06-05 23:59:59.174|38336|
|ESAM:vicc_polling|2018-06-05|TEST|main|2018-06-05 00:00:02.795|2018-06-05 23:59:58.265|19159|
|ESAM:vicc_sanity_check|2018-06-05|AD2|main|2018-06-05 12:59:34.020|2018-06-05 13:37:44.024|6|

Note the ESAM:AT_messages:main present in the first and missing in the second.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.