Splunk Search

Missing values in results

Jakfarh
Loves-to-Learn

I found this very usefull search for a dashboard on gosplunk:

| rest /services/data/indexes | dedup title | fields title | rename title AS index 

    | map maxsearches=1500 search="| metadata type=sourcetypes index=\"$index$\"

    | eval Retention=tostring(abs(lastTime-firstTime), \"duration\")

    | convert ctime(firstTime) ctime(lastTime)

    | sort lastTime

    | rename totalCount AS \"TotalEvents\" firstTime AS \"FirstEvent\" lastTime AS \"LastEvent\"

    | eval index=\"$index$\""

    | fields index  sourcetype TotalEvents FirstEvent LastEvent Retention

    | sort sourcetype

    | stats list(sourcetype) AS SourceTypes list(TotalEvents) AS TotalEvents list(FirstEvent) AS "First Event" by index

    | append [| rest /services/data/indexes | dedup title | fields title | rename title AS index]

    | dedup index | fillnull value=null SourceTypes TotalEvents "First Event" "Last Event" Retention | sort index | search index=* (SourceTypes=*)
However, when i first ran it, some of the "lastevent" values appeared correctly. Ever since then, "LastEvent" and "Retention" have allways been "Null". I cant figure out why i dont get any return values on these fields.

I got an error saying the limit on "list" command of 100 was surpassed. So i tried replacing "list()" with "values()" in the search, but the result is the same, just without the error. 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is it you are trying to achieve?

Can you still get what you want if you try these changes?

    | sort 0 sourcetype

    | stats list(TotalEvents) AS TotalEvents list(FirstEvent) AS "First Event" by index, sourcetype
0 Karma

Jakfarh
Loves-to-Learn

Unfortunatly, i still get null values with these changes.

I'm trying to get a comprehensive dashboard, that shows every sourcetype, pr. index, with a first event time, and last event time, to see when we started logging events, and to see if we suddenly stop, or have an unusually large gap since last event. 
We want to set up an alarm to notify us, if an index havnt recieved an event of a specific sourcetype, within a given threshold of time. (Sorry if my english is slightly off here).

This specific dashboard is supposed to be a complete sort of dictionary over our indexes and sourcetypes 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...