Reporting

savedsearch builds table, then all the data disappears

fk319
Builder

I have a saved search that when I run the search manually, I get the data I expect. When I run it as a saved search, it populates the displayed table as expected and then it all dissapears when the job is completed. (todays search returns about 4000 records.) When I inspect the job, the last stats and eval are highlighted yellow.

index="csradmin" sourcetype="SI_PROD" user="*" succ="succ" type="*"
    (action="account_lookup" OR action="bind_device" OR action="reprov_device") 
| eval completed=if(action=="account_lookup","Attempted","Completed")
| eval installer=case(
    match(user,"tech*"), "Tech",
    user="cust", "Customer",
    0==0, "Netiher" )
| stats count(eval(completed="Attempted")) as com_at, count(eval(completed="Completed")) as com_cmp by act, installer, type
| eval com_at=max(com_at, com_cmp)

This is a common search that I need to further refine the data to build tables.

I have seen this behavior in the past, but it has been several months. In this case, I added a fields command to the end of the saved search, but it did not make a difference. Which I click on "Event List", instead of "Results Table", the expected logs are there.

Does anyone know why the table disappears and how to get it back?

Tags (1)
0 Karma
1 Solution

fk319
Builder

I opened a case with tech support and found that if I remove the extra line breaks in my saved search, things started to work.

View solution in original post

0 Karma

fk319
Builder

I opened a case with tech support and found that if I remove the extra line breaks in my saved search, things started to work.

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...