Splunk Search
Highlighted

Why am I getting "No matching events found" on the next page when I click on _time in my search results?

Explorer

Hi Everyone,

I have written the search below to display the information about integer and seconds value and other data. It is displaying all the information on the dashboard, but when I click on the _time field, it is not displaying any data on the next page, and I'm getting "No matching events found"could you please any help me on this?

Search:

index=web_usit source="/weblogs/com9072/clusterB-02/resolvetransactionservices.log" TransactionSearchController OR TransactionSearchDelegateImpl | dedup _raw | transaction startswith="Entered Search Transaction(s)" endswith="Transaction Search Query [] Time" | rex field=_raw ", Integer=\[(?\d+)\]" | rex "=\s+(?[\d\.]+)" | rename seconds AS total_search_time | rename Integer AS Result_Count | table _time,  total_search_time, Resuld_Count,

data like

0 Karma
Highlighted

Re: Why am I getting "No matching events found" on the next page when I click on _time in my search results?

Super Champion

My guess is that it has to do with the transaction. When you click on _time, what does the query change to?

0 Karma
Highlighted

Re: Why am I getting "No matching events found" on the next page when I click on _time in my search results?

Explorer

I'm trying to do the transaction between the events and if we click on _time row it should show the group of event in next page.

Raw data:

Dec 06, 2016 10:02:04 AM CST INFO (TransactionSearchController.java:48) - String=[Entered Search Transaction(s)]
Dec 06, 2016 10:02:05 AM CST INFO (TransactionSearchDelegateImpl.java:45) - String=[Initiating Transaction search for Query], String=[test567]
Dec 06, 2016 10:02:05 AM CST INFO (TransactionSearchDelegateImpl.java:48) - transaction search without timeout
Dec 06, 2016 10:02:39 AM CST INFO (TransactionSearchDelegateImpl.java:54) - String=[Transaction Search Results. Transactions Count Is], String=[test567], Integer=[60]
Dec 06, 2016 10:02:39 AM CST INFO (TransactionSearchDelegateImpl.java:55) - Transaction Search Query [test567] Time (in seconds) = 34.267

0 Karma