Reporting

savedsearch builds table, then all the data disappears

fk319
Builder

I have a saved search that when I run the search manually, I get the data I expect. When I run it as a saved search, it populates the displayed table as expected and then it all dissapears when the job is completed. (todays search returns about 4000 records.) When I inspect the job, the last stats and eval are highlighted yellow.

index="csradmin" sourcetype="SI_PROD" user="*" succ="succ" type="*"
    (action="account_lookup" OR action="bind_device" OR action="reprov_device") 
| eval completed=if(action=="account_lookup","Attempted","Completed")
| eval installer=case(
    match(user,"tech*"), "Tech",
    user="cust", "Customer",
    0==0, "Netiher" )
| stats count(eval(completed="Attempted")) as com_at, count(eval(completed="Completed")) as com_cmp by act, installer, type
| eval com_at=max(com_at, com_cmp)

This is a common search that I need to further refine the data to build tables.

I have seen this behavior in the past, but it has been several months. In this case, I added a fields command to the end of the saved search, but it did not make a difference. Which I click on "Event List", instead of "Results Table", the expected logs are there.

Does anyone know why the table disappears and how to get it back?

Tags (1)
0 Karma
1 Solution

fk319
Builder

I opened a case with tech support and found that if I remove the extra line breaks in my saved search, things started to work.

View solution in original post

0 Karma

fk319
Builder

I opened a case with tech support and found that if I remove the extra line breaks in my saved search, things started to work.

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, October Edition

Welcome to the October edition of our Community Spotlight! The Splunk Community is a treasure trove of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...