Splunk Enterprise

Issue with "Create Table View"

bipul
Observer

I've written a Splunk Query and ran it, it's giving the result as expected but as soon as I click on "Create Table View" some of the field disappears which were earlier coming post the query run. Not sure what is wrong, could anyone help?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you be a bit more specific? Which fields have "disappeared"? What does your SPL look like?

0 Karma

bipul
Observer
index="aws" earliest=-7d@d latest=@d
| search "Method request" "systemId"
| rex field=_raw "\((?<messageId>[^)]+)\)[^:]+:\s*\{(?<messageFields>.*)\}"
| rex field=messageFields "Id=(?<systemId>[^,]+)"
| rex field=messageFields "product=(?<product>[^,]+(?:,[^,]+)*)(?=, systemId=)"
| rex field=_raw "Field=\"(?<eventFieldName>[^\"]+)\""
| rex field=_raw "FieldValue=\"(?<eventFieldValue>[^\"]+)\""
| rex field=_raw "type=\"(?<eventType>[^\"]+)\""
| search product="O,U" systemId!="0454c7f5"
| dedup messageId
| join type=left messageId [ | from datamodel:"getStatusCodes" | fields messageId, statusCode ]
| join type=left systemId [ | from datamodel:"verifyCalls" | rename siteCoreId as systemId | eval Verified="Yes" | fields systemId, Verified ]
| eval Verified=coalesce(Verified, "No")
| table _time, messageId, systemId, statusCode, Verified
| sort - _time
| head 10000


Above is the Splunk Query.  When I search this query I get these fields in the output (_time, messageId, systemId, statusCode, Verified) but when I click on "Create Table View" only (_time, messageId, statusCode) fields are coming.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Since you are using joins, you could be hitting limits on the subsearches - have you tried a shorter timeframe?

0 Karma

bipul
Observer

Yes, I tried fetching for only 1 day instead of 7 days but still the same issue. After clicking on "Create Table View" those fields are disappearing. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Why not use your search in a dashboard panel table?

0 Karma

bipul
Observer

I'm not sure how to do that. Let me figure this out how to search in dashboard panel. I'm new to Splunk still learning. 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...