Splunk Search

Query in Verbose mode results but while finalising in Fast mode, the results arent displaying ?

sangs8788
Communicator

Hi,

I have a query which finalises me all JSP pages performance for every month. It provides me correct result in Verbose mode.
But while running on Fast mode, the results shows up but at the end while finalising, there are no results found for the same query.
It is strange though. Could someone help me out on what is wrong in here ?

index=test  page=JSP  |eval req = tostring(req) |convert num(AvgWallTime) as AvgWallTime |eval AvgWallTime=if(AvgWallTime=="",0,AvgWallTime) | chart avg(AvgWallTime) as Average  over month by req useother=f limit=100
Tags (1)
0 Karma
1 Solution

sangs8788
Communicator

Got this fixed. Looks like one of the Request name is too large to be a column field name. That is the reason it didnt show the results.

View solution in original post

0 Karma

sangs8788
Communicator

Got this fixed. Looks like one of the Request name is too large to be a column field name. That is the reason it didnt show the results.

0 Karma

p_gurav
Champion

Which version of splunk you are using? Did you try using smart mode?

0 Karma

sangs8788
Communicator

Version 7.0.2. The problem is i want this to be add it as a panel in dashboard. I suppose the panels are in fast mode. So i need this to work in fast mode.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...