Need help in query

[Praz_123]

Need help for the below Query 

index=na sourcetype=na:co state=down host_state_type="HARD" [| tstats prestats=f values(host) as host_name WHERE index=df AND host!=1* | eval host_name=lower(host_name) | mvexpand host_name ]
| stats count as DownMins by host_name |sort - DownMins|head 25 | addcoltotals label=Total labelfield=host_name


While am running the query for last 24 hours its showing results but when I reduced the time range to less than 24 hours it's not showing any output but previously this query is running fine.

Also while I run the query like - 

It shows me output for last 24 hours   - index=na sourcetype=na:co state=down host_state_type="HARD"
while I search the same host in  - index= df  host="ooo"

Am getting the results while combining both not getting results less than 24 hours 

Also I can see in the backend those host are down but not showing in Splunk query 

[PickleRick]

Ok. There are some diagnostic steps you can do

1. Run the subsearch on its own and check what results it yields if any and how long it takes to complete.

2. Run the initial search (the part before the first | stats) and check what results you're getting.

3. Check your data. If reducing time range "breaks" your search you might have issues with your data/ingestion (misconfigured timestamp recognition, delay in ingestion pipeline and so on).

[gcusello]

Hi @Praz_123 ,

let me understand: you want to filter results from the main search with the values of the firls of host_name from the subsearch, is it correct?

please try this:

index=na sourcetype=na:co state=down host_state_type="HARD" [ | tstats count WHERE index=df AND host!=1* BY host | eval host_name=lower(host) | fields host_name ]
| stats count as DownMins by host_name 
| sort - DownMins|head 25 
| addcoltotals label=Total labelfield=host_name 

Ciao.

Giuseppe