Splunk Search

Two evals in one query , query not returning results

msrama5
Explorer

Hi All, I have the following query with 5 source types and 2 evals in one query, common field between source types is correlationid and elapsed time which may or may not exist and using coalesce since name formats can be different, I want to return unique correlation id in different sources and elapsedtime and return null if it does not exist, when I run the query below it is not returning any results,, what is wrong with the query below, is using 2 evals an issue ?

(sourcetype=source1) OR (sourcetype=source2) OR (sourcetype=source3) OR (sourcetype=source4) OR (sourcetype=source5)
| eval CorrelationId=coalesce('Properties.CorrelationId',CorrelationId,x-correlation-id,x_correlation_id )
| eval ElapsedTime = coalesce('Properties.elapsedMs','Properties.ElapsedMs','Properties.ElapsedTime',elapsedMs,elapsed)
| stats values(ElapsedTime) as ElapsedTime by CorrelationId sourcetype
| xyseries CorrelationId sourcetype ElapsedTime
| fillnull source1 source2 source3 source4 source5 value="Not exists"
| table CorrelationId source1 source2 source3 source4 source5

| sort CorrelationId

Labels (3)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Having more than one eval is not a problem. Why is a problem, however, is stats with a field (ElapsedTime) that may be null. That will give you no results. Avoid that by adding a constant to your coalesce.

| eval ElapsedTime = coalesce('Properties.elapsedMs','Properties.ElapsedMs','Properties.ElapsedTime',elapsedMs,elapsed, 0)
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...