Splunk Search

Why am I getting "No matching events found" on the next page when I click on _time in my search results?

lksridhar
Explorer

Hi Everyone,

I have written the search below to display the information about integer and seconds value and other data. It is displaying all the information on the dashboard, but when I click on the _time field, it is not displaying any data on the next page, and I'm getting "No matching events found"could you please any help me on this?

Search:

index=web_usit source="/weblogs/com9072/clusterB-02/resolvetransactionservices.log" TransactionSearchController OR TransactionSearchDelegateImpl | dedup _raw | transaction startswith="Entered Search Transaction(s)" endswith="Transaction Search Query [] Time" | rex field=_raw ", Integer=\[(?\d+)\]" | rex "=\s+(?[\d\.]+)" | rename seconds AS total_search_time | rename Integer AS Result_Count | table _time,  total_search_time, Resuld_Count,

data like

0 Karma

cmerriman
Super Champion

My guess is that it has to do with the transaction. When you click on _time, what does the query change to?

0 Karma

lksridhar
Explorer

I'm trying to do the transaction between the events and if we click on _time row it should show the group of event in next page.

Raw data:

Dec 06, 2016 10:02:04 AM CST INFO (TransactionSearchController.java:48) - String=[Entered Search Transaction(s)]
Dec 06, 2016 10:02:05 AM CST INFO (TransactionSearchDelegateImpl.java:45) - String=[Initiating Transaction search for Query], String=[test567]
Dec 06, 2016 10:02:05 AM CST INFO (TransactionSearchDelegateImpl.java:48) - transaction search without timeout
Dec 06, 2016 10:02:39 AM CST INFO (TransactionSearchDelegateImpl.java:54) - String=[Transaction Search Results. Transactions Count Is], String=[test567], Integer=[60]
Dec 06, 2016 10:02:39 AM CST INFO (TransactionSearchDelegateImpl.java:55) - Transaction Search Query [test567] Time (in seconds) = 34.267

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...