Splunk Search

Results desappearing at finalizing time

emaccaferri
Communicator

Hi!

I'm using this search to calculate the exit rate of each page visited on a web site, count how many time a page was view and count how many time a page is the exit page:

...| where isnotnull(pagename) | eventstats count as visits by pagename | eval cookie=visid_high.visid_low.visit_num | transaction mvlist=t cookie | eval lastpage=mvindex(pagename,-1) | eventstats count as exits by lastpage | table pagename visits lastpage exits | where match(lastpage, pagename) |dedup pagename | eval exit_rate=exits/visits*100

Why this search finds results if I choose a period of 2 days or so, but for 3 months it answers No results found?
The job inspector puts in yellow

| table pagename visits lastpage exits | where match(lastpage, pagename) |dedup pagename | eval exit_rate=exits/visits*100

Thanks

Erica

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can give the Search Exploder in SideviewUtils 3+ a shot for debugging at each pipe.

0 Karma

MuS
Legend

Hi emaccaferri,

without any detailed information this is hard to answer, but try to set a maxspan option for transaction. If not set, transaction is using by default no limit - meaning if you search 3 month, transaction is search all events in the 3 month and will build a transaction set based on cookie.

hope this helps ...

cheers, MuS

0 Karma

emaccaferri
Communicator

wich kind of detailed information do you need?
I knew how transaction works, but what's splunk problem to eventually makes a 3 months transaction?
The query is not wrong in syntax, for a single day o few more I get what I need.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...