Results desappearing at finalizing time

[emaccaferri]

Hi!

I'm using this search to calculate the exit rate of each page visited on a web site, count how many time a page was view and count how many time a page is the exit page:

...| where isnotnull(pagename) | eventstats count as visits by pagename | eval cookie=visid_high.visid_low.visit_num | transaction mvlist=t cookie | eval lastpage=mvindex(pagename,-1) | eventstats count as exits by lastpage | table pagename visits lastpage exits | where match(lastpage, pagename) |dedup pagename | eval exit_rate=exits/visits*100

Why this search finds results if I choose a period of 2 days or so, but for 3 months it answers No results found?
The job inspector puts in yellow

| table pagename visits lastpage exits | where match(lastpage, pagename) |dedup pagename | eval exit_rate=exits/visits*100

Thanks

Erica

[martin_mueller]

You can give the Search Exploder in SideviewUtils 3+ a shot for debugging at each pipe.

[MuS]

Hi emaccaferri,

without any detailed information this is hard to answer, but try to set a maxspan option for transaction. If not set, transaction is using by default no limit - meaning if you search 3 month, transaction is search all events in the 3 month and will build a transaction set based on cookie.

hope this helps ...

cheers, MuS

[emaccaferri]

wich kind of detailed information do you need?
I knew how transaction works, but what's splunk problem to eventually makes a 3 months transaction?
The query is not wrong in syntax, for a single day o few more I get what I need.