Reporting

Report is missing first column of data

baegoon
Explorer

I have three reports that are based on transactions. The transactions are similar they report different process states. One of my reports does not show the first column of data. For instance I have "HelpdeskAgent", "RequestType", "Request Last Name", "Request Firstname", Request ID, Request Duration all in a table and the Helpdeskagent does not have the information in the column. I can run the report or goto the dashboard for the search in my search head and the HelpDeskAgent column is there and all three reports work. If I run the report manually all the columns populate. However when I export to PDF the column is missing for that report. This happens for the automated PDF export report as well. I don't thin it's a search term issue. However it could be a formatting issue??
Should I submit a support ticket for this?

Here is the search:

eventtype=IDMlogs  workflowstatus="Workflow_Started" OR workflowstatus="Workflow_Ended" OR workflowstatus="Workflow_Error" OR workflowstatus="User_Message" 
| transaction processid startswith=eval(workflowstatus="Workflow_Started") endswith=eval(workflowstatus="Workflow_Ended")
| eval duration = tostring(duration,"duration")
| sort -duration
| table helpdeskagent employeeType workforceID workforceIDGen surname givenName duration
| rename duration as "Time in Process", helpdeskagent as " Agent Assigned", surname as "Requestor Last Name", givenName as "Requestor First Name"
0 Karma

woodcock
Esteemed Legend

It doesn't matter what the search is: if it generates a table and those tabular results are different when you export as PDF, you need to open a support case.

0 Karma

baegoon
Explorer

Thanks! I will open one now.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

I notice that you have three different capitalizations for helpdeskagent in your question. Splunk is always case-sensitive for field names.

To start with, go back and make sure that you have spelled and capitalized the word exactly the way it is in the data.

Once you have verified that, we can try other debug methods.

0 Karma

baegoon
Explorer

In my intro to the problem please treat that as Agent Assigned t. But please look at the search rather than my intro of the problem in regards to renaming helpdeskagent. This is why I included the search. Also helpdeskagent is a rex that was created using erex.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...