Reporting

savedsearch builds table, then all the data disappears

fk319
Builder

I have a saved search that when I run the search manually, I get the data I expect. When I run it as a saved search, it populates the displayed table as expected and then it all dissapears when the job is completed. (todays search returns about 4000 records.) When I inspect the job, the last stats and eval are highlighted yellow.

index="csradmin" sourcetype="SI_PROD" user="*" succ="succ" type="*"
    (action="account_lookup" OR action="bind_device" OR action="reprov_device") 
| eval completed=if(action=="account_lookup","Attempted","Completed")
| eval installer=case(
    match(user,"tech*"), "Tech",
    user="cust", "Customer",
    0==0, "Netiher" )
| stats count(eval(completed="Attempted")) as com_at, count(eval(completed="Completed")) as com_cmp by act, installer, type
| eval com_at=max(com_at, com_cmp)

This is a common search that I need to further refine the data to build tables.

I have seen this behavior in the past, but it has been several months. In this case, I added a fields command to the end of the saved search, but it did not make a difference. Which I click on "Event List", instead of "Results Table", the expected logs are there.

Does anyone know why the table disappears and how to get it back?

Tags (1)
0 Karma
1 Solution

fk319
Builder

I opened a case with tech support and found that if I remove the extra line breaks in my saved search, things started to work.

View solution in original post

0 Karma

fk319
Builder

I opened a case with tech support and found that if I remove the extra line breaks in my saved search, things started to work.

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...