Splunk Search

Two evals in one query , query not returning results

msrama5
Explorer

Hi All, I have the following query with 5 source types and 2 evals in one query, common field between source types is correlationid and elapsed time which may or may not exist and using coalesce since name formats can be different, I want to return unique correlation id in different sources and elapsedtime and return null if it does not exist, when I run the query below it is not returning any results,, what is wrong with the query below, is using 2 evals an issue ?

(sourcetype=source1) OR (sourcetype=source2) OR (sourcetype=source3) OR (sourcetype=source4) OR (sourcetype=source5)
| eval CorrelationId=coalesce('Properties.CorrelationId',CorrelationId,x-correlation-id,x_correlation_id )
| eval ElapsedTime = coalesce('Properties.elapsedMs','Properties.ElapsedMs','Properties.ElapsedTime',elapsedMs,elapsed)
| stats values(ElapsedTime) as ElapsedTime by CorrelationId sourcetype
| xyseries CorrelationId sourcetype ElapsedTime
| fillnull source1 source2 source3 source4 source5 value="Not exists"
| table CorrelationId source1 source2 source3 source4 source5

| sort CorrelationId

Labels (3)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Having more than one eval is not a problem. Why is a problem, however, is stats with a field (ElapsedTime) that may be null. That will give you no results. Avoid that by adding a constant to your coalesce.

| eval ElapsedTime = coalesce('Properties.elapsedMs','Properties.ElapsedMs','Properties.ElapsedTime',elapsedMs,elapsed, 0)
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...