- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Contingency: no results found
arpoador
New Member
11-01-2013
11:17 AM
I have two fields: EventCode (66 distinct values) and date_mday (28 distinct values)
But when I run:
' * | contingency EventCode date_mday '
On over 1.2M events I get no results. What am I doing wrong?
Thanks
Also, suggestion: If a field is mistyped, show it in red if it doesn't exist.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
arpoador
New Member
11-01-2013
02:50 PM
I used * just to make sure I was looking at the entire event set in case I was missing something. When I changed contingency to ctable (and changed nothing else), I get the table I expected. Interesting. Thanks for your reply.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
loatswil
Path Finder
11-01-2013
01:03 PM
If those are indeed valid fields in the search, I'd look at the time frame. Make sure those events did occur during the selected time frame.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

somesoni2
Revered Legend
11-01-2013
12:47 PM
Could you try to give proper index/sourcetype name instead of using *??
