Not getting the last week of data in graph when using the filter search Device_Type="mobile"

[uagraw01]

In the above, I am comparing the last 15m data to the current week's 15m data. And I am getting good results.

But here in the same search when I am using the filter search Device_Type="mobile", I am not getting the last week of data in graph. Please help me out for this.

[uagraw01]

@ITWhisperer  & @gcusello Yes, I can see no events for deviceType for last week. Those events appended to Splunk from 1st sep.

[ITWhisperer]

So, the chart is providing the correct result. Splunk is not particular good at displaying things which don't exist. You can force it to by artificially adding events (with zero counts for example), but you have to tell Splunk which events you want adding.

[gcusello]

Hi @uagraw01,

if you haven't events that match the added condition, you have only to modify the search condition or accept these results.

Ciao.

Giuseppe

[gcusello]

Hi @uagraw01,

there's only one answer: you haven't events that match the condition on week ago.

You can check this running your search only on the first time frame.

Ciao.

Giuseppe

[ITWhisperer]

This would seem to suggest that you have no events from last week for this device type - have you checked that there are actually events to be found?