Splunk Search

Sub-searches using savedsearch returns results, but columns are labeled "NULL"

yacht_rock
Explorer

Using savedsearch and timechart, I'm getting NULL where I'd expect the values of "myfield"

Base search (@m to -1h@h)

 index=myindex myfield=*FOO* | timechart span=1h count by myfield

And aggregating searches like

 | savedsearch mysavedsearch1 | timechart span=1d count by myfield

Aggregating search has time stamps in correct grouping, but the other column is labeled NULL when it should be values like myfield-foo, foo-myfield, etc..

0 Karma
1 Solution

somesoni2
Revered Legend

Once you fire your first query, the columns available are _time and value of myfield (not the column with name myfield). So when you're using your second search, it'll return NULL as there is no column with name myfield. This is how you should implement this

Base search (@m to -1h@h)

 index=myindex myfield=*FOO* | bucket span=1h _time | stats count by _time myfield

And aggregating searches like

| savedsearch mysavedsearch1 | timechart span=1d sum(count) by myfield

View solution in original post

somesoni2
Revered Legend

Once you fire your first query, the columns available are _time and value of myfield (not the column with name myfield). So when you're using your second search, it'll return NULL as there is no column with name myfield. This is how you should implement this

Base search (@m to -1h@h)

 index=myindex myfield=*FOO* | bucket span=1h _time | stats count by _time myfield

And aggregating searches like

| savedsearch mysavedsearch1 | timechart span=1d sum(count) by myfield

View solution in original post