Splunk Search

Results desappearing at finalizing time

emaccaferri
Communicator

Hi!

I'm using this search to calculate the exit rate of each page visited on a web site, count how many time a page was view and count how many time a page is the exit page:

...| where isnotnull(pagename) | eventstats count as visits by pagename | eval cookie=visid_high.visid_low.visit_num | transaction mvlist=t cookie | eval lastpage=mvindex(pagename,-1) | eventstats count as exits by lastpage | table pagename visits lastpage exits | where match(lastpage, pagename) |dedup pagename | eval exit_rate=exits/visits*100

Why this search finds results if I choose a period of 2 days or so, but for 3 months it answers No results found?
The job inspector puts in yellow

| table pagename visits lastpage exits | where match(lastpage, pagename) |dedup pagename | eval exit_rate=exits/visits*100

Thanks

Erica

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can give the Search Exploder in SideviewUtils 3+ a shot for debugging at each pipe.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi emaccaferri,

without any detailed information this is hard to answer, but try to set a maxspan option for transaction. If not set, transaction is using by default no limit - meaning if you search 3 month, transaction is search all events in the 3 month and will build a transaction set based on cookie.

hope this helps ...

cheers, MuS

0 Karma

emaccaferri
Communicator

wich kind of detailed information do you need?
I knew how transaction works, but what's splunk problem to eventually makes a 3 months transaction?
The query is not wrong in syntax, for a single day o few more I get what I need.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...