Splunk Search

Two evals in one query , query not returning results

msrama5
Explorer

Hi All, I have the following query with 5 source types and 2 evals in one query, common field between source types is correlationid and elapsed time which may or may not exist and using coalesce since name formats can be different, I want to return unique correlation id in different sources and elapsedtime and return null if it does not exist, when I run the query below it is not returning any results,, what is wrong with the query below, is using 2 evals an issue ?

(sourcetype=source1) OR (sourcetype=source2) OR (sourcetype=source3) OR (sourcetype=source4) OR (sourcetype=source5)
| eval CorrelationId=coalesce('Properties.CorrelationId',CorrelationId,x-correlation-id,x_correlation_id )
| eval ElapsedTime = coalesce('Properties.elapsedMs','Properties.ElapsedMs','Properties.ElapsedTime',elapsedMs,elapsed)
| stats values(ElapsedTime) as ElapsedTime by CorrelationId sourcetype
| xyseries CorrelationId sourcetype ElapsedTime
| fillnull source1 source2 source3 source4 source5 value="Not exists"
| table CorrelationId source1 source2 source3 source4 source5

| sort CorrelationId

Labels (3)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Having more than one eval is not a problem. Why is a problem, however, is stats with a field (ElapsedTime) that may be null. That will give you no results. Avoid that by adding a constant to your coalesce.

| eval ElapsedTime = coalesce('Properties.elapsedMs','Properties.ElapsedMs','Properties.ElapsedTime',elapsedMs,elapsed, 0)
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...