Splunk Search

Longer Period of Time showing Fewer Results??

essklau
Path Finder

Hi,

I have a search which returns 37 results for one date (May 30), but 0 results for May 30-Jun2. I am failing to see in the search anything that should be using time or cancelling results from a longer search period.

The search is:

eventtype=mssql-audit class_type=U | lookup dm_audit_actions action_id OUTPUT name
| join host, session_id, server_principal_id [ search eventtype=mssql-audit class_type="*" succeeded="true" src_ip="*" | eval src_ip=if(src_ip=="local machine",host,src_ip) | stats values(src_ip) as src_ip by host,session_id,server_principal_id ]

So why does a search give me results for a period of time, but no results for "period of time" + a day?

Any suggestions would be appreciated.

Tags (1)
0 Karma

somesoni2
Revered Legend

Could you check if individual searches (main search and subsearch) are returning data, for the period May30-Jun02, independently? and have matching events so that join can be applied?

0 Karma

hagjos43
Contributor

try this to help diagnose your problem.

Apply a _time bucket within your query and do a |stats count by _time

| bucket _time span=24h | stats count by _time
0 Karma

essklau
Path Finder

I switched the span to 1h. There are events in the one day search that break down as expected by the hour. The one day + more days search still returns zero results.

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...