Why my search is return no result ?

[mah]

Hi, 

I have a search like this applied on many queries : 

index="abs" field1="aaa" field2="bbb" 
| eval dummy="true"
| eval epochnow = now()
| eval epochHorodate=strptime(Horodate, "%Y-%m-%dT%H:%M:%S")

| eval Horodate=strftime(epochHorodate, "%Y-%m-%dT%H:%M:%S")
| where epochnow>=epochHorodate
| eval _time=Horodate
| stats count(eval(Statut=="KO")) as KO by _time
| sort _time ASC
| appendpipe
[| stats sum(KO) as KO
| eval _time=now()]

Usually the search return a result like this : 

I have the sum of KO / day. And then I use the single value for the visualization : 

My issue is that on one query I have this error :

And it doesn't span bay day anymore.

Can you help me please ?

[gcusello · Accepted solution]

Hi @mah,

at first you don't need to rename Horodate as _time (| eval _time=Horodate)

then I don't like the double "=".

Then, if you want to use stats BY _time (or Horodate), you have to put a bin command before to group values, otherwise you have touse the timechart command that permits to define the span:

so:

index="abs" field1="aaa" field2="bbb" 
| eval epochnow = now()
| eval epochHorodate=strptime(Horodate, "%Y-%m-%dT%H:%M:%S")
| where epochnow>=epochHorodate
| bin Horodate span=1d
| stats count(eval(Statut="KO")) as KO values(ASC) AS ASC by Horodate
| sort _time ASC

Ciao.

Giuseppe

[gcusello]

Hi @mah.,

good!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated  😉

[mah]

The bin doesn't work with the Horodate :

But works with _time :

[gcusello]

Hi @mah,

do it solve your need?

Ciao.

Giuseppe

[mah]

It works. 

Thanks for helping!

[gcusello]

Hi @mah,

The approach to debug a search is to delete one row at a time from the end of the search to understand  which row has the problem.

Anyway, probably the problem is that you want to sort for ASC (| sort _time ASC), but ASC isn't present in the previous stats command, so you haven't anymore after "| stats count(eval(Statut=="KO")) as KO by _time".

Ciao.

Giuseppe

[mah]

I put the "| stats count(eval(Statut=="KO")) as KO by _time" at the end in order to answer to this other issue : 

https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-not-working-at-all/m-p/519370#M3...

I've already tried to see command by command but I don't find where it goes wrong. 

I find out that at this command :

index=abc 

| eval dummy="true"
| eval epochnow = now()
| eval epochHorodate=strptime(Horodate, "%Y-%m-%dT%H:%M:%S")| eval Horodate=strftime(epochHorodate, "%Y-%m-%dT%H:%M:%S")
| where epochnow>=epochHorodate
| eval _time=Horodate

The _time returned like this : 

NaN/NaN/aN
NaN:NaN:NaN.000 AM

and then when I added this command and put a single value, the problem is the same : 

"These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached."

[gcusello]

Hi @mah,

running 

index=abc 
| eval dummy="true"
| eval epochnow = now()
| eval epochHorodate=strptime(Horodate, "%Y-%m-%dT%H:%M:%S")| eval Horodate=strftime(epochHorodate, "%Y-%m-%dT%H:%M:%S")
| table _time epochnow epochHorodate

which results do you have?

Ciao.

Giuseppe

[mah]

Hi @gcusello ,

I run the above command : 

and I run the eval command I have in my begining search : 

But when I added the following command : | stats count(eval(Statut=="KO")) as KO by _time

The problem still the same :  it doesn't make a span by day anymore and the visualization goes wrong :