Query not displaying any events

[pratapa]

User complained that following query is not displaying any events.

index=main sourcetype=wms_oracle_sessions | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program | search warehouse=wk | stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program

what could be the problem in the above query.

[woodcock]

Try this:

index="main" AND sourcetype="wms_oracle_sessions" AND warehouse="wk"
| bucket _time span=5m
| stats count AS sessions BY _time warehouse machine program
| stats sum(sessions) AS psessions BY _time program
| stats avg(psessions) BY program

[to4kawa]

Query not displaying any events
Where?
1st stats?
search?
2nd stats?
last timechart?

SPL runs in order.
Please run the query line by line.
You can find where the problem is.
Good luck.

[gcusello]

Hi @pratapa,
I see that you filter your results for warehouse=wk that's one of the BY clause fields in the first stats command, it's always better to filter in the main search so you don't need it in the first stats, in addition the clause machine isn't used so you don't need the two stats commands.
so you could simplify your search in this way:

index=main sourcetype=wms_oracle_sessions warehouse=wk
| timechart span=5m count by program

Ciao.
Giuseppe

[richgalloway]

One possibility is there are no events to display.
Another possibility is one of the fields in the by clause of stats is null. That will cause stats to return no results.

[pratapa]

Thanks for your reply.

We tried modifying the query as follows but No results found.

index=main sourcetype=wms_oracle_sessions warehouse=wk | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program| stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program

We tried the below query as well, but no results found.

index=main sourcetype=wms_oracle_sessions warehouse=wk | timechart span=5m count by program

Even when we try the below ones, no results found.

index=main sourcetype=wms_oracle_sessions warehouse=wk

index=main sourcetype=wms_oracle_sessions

sourcetype=wms_oracle_sessions

It seems source type wms_oracle_sessions does not exist. Please suggest what can be done.

[richgalloway]

Searching only for sourcetype may not work, depending on your default index(es). Try index=* sourcetype=wms_oracle_sessions. If that returns nothing then you need to investigate why you are not receiving any data of that source type.