Splunk Search

Two evals in one query , query not returning results

msrama5
Explorer

Hi All, I have the following query with 5 source types and 2 evals in one query, common field between source types is correlationid and elapsed time which may or may not exist and using coalesce since name formats can be different, I want to return unique correlation id in different sources and elapsedtime and return null if it does not exist, when I run the query below it is not returning any results,, what is wrong with the query below, is using 2 evals an issue ?

(sourcetype=source1) OR (sourcetype=source2) OR (sourcetype=source3) OR (sourcetype=source4) OR (sourcetype=source5)
| eval CorrelationId=coalesce('Properties.CorrelationId',CorrelationId,x-correlation-id,x_correlation_id )
| eval ElapsedTime = coalesce('Properties.elapsedMs','Properties.ElapsedMs','Properties.ElapsedTime',elapsedMs,elapsed)
| stats values(ElapsedTime) as ElapsedTime by CorrelationId sourcetype
| xyseries CorrelationId sourcetype ElapsedTime
| fillnull source1 source2 source3 source4 source5 value="Not exists"
| table CorrelationId source1 source2 source3 source4 source5

| sort CorrelationId

Labels (3)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Having more than one eval is not a problem. Why is a problem, however, is stats with a field (ElapsedTime) that may be null. That will give you no results. Avoid that by adding a constant to your coalesce.

| eval ElapsedTime = coalesce('Properties.elapsedMs','Properties.ElapsedMs','Properties.ElapsedTime',elapsedMs,elapsed, 0)
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...