whats preventing me to get the desired output

[pench2k19]

Hi Team,

I am not able to get the values for SLA Time and time_diff_epoch.

when i am running two queirs indvidually i am receivng the results.

index=XXX sourcetype="XXX"
| rex "info\s:\s\+{4}\s(?<job_status>\w+)\s\+{4}"  max_match=0
| eval status=mvindex(job_status,-1)
| eval time=strptime(CNAPP_entime, "%Y-%m-%d-%H-%M-%S") 
| eval Starttime=strftime(time,"%m/%d/%y %H:%M:%S") 
| eval Endttime=strftime(time,"%Y-%m-%d %H:%M:%S")  
| where status!="" |  search status="COMPLETED"  
| rename  "CNAPP_AutosysJobName" as "Autosys Job" 
| lookup CNAPP_Joblevel_details.csv "Autosys Job" OUTPUT "SLA Time"
| eval Endttime_epoch=strptime(Endttime,"%Y-%m-%d %H:%M:%S") 
| eval sla_time_epoch =strptime("SLA Time","%Y-%m-%d %H:%M:%S") 
| eval time_diff_epoch = sla_time_epoch - Endttime_epoch
|  where  NOT like (time_diff_epoch,"-%" ) 
| table  "Autosys Job" "Endttime" "SLA Time" time_diff_epoch

can anyone tell, why am i getting this problem, it worked well before few days, now its having some problem.

@jkat54 @somesoni2 @woodcock

[woodcock]

You did not show us the "individual queries" that are "receiving the results".

[woodcock]

Try this (field names with spaces are EVIL😞

index=XXX sourcetype="XXX"
| rex "info\s:\s+{4}\s(?\w+)\s+{4}" max_match=0
| eval status=mvindex(job_status,-1)
| eval time=strptime(CNAPP_entime, "%Y-%m-%d-%H-%M-%S")
| eval Starttime=strftime(time,"%m/%d/%y %H:%M:%S")
| eval Endttime=strftime(time,"%Y-%m-%d %H:%M:%S")
| search status="COMPLETED"
| rename "CNAPP_AutosysJobName" AS "Autosys Job"
| lookup CNAPP_Joblevel_details.csv "Autosys Job" OUTPUT "SLA Time"
| eval sla_time_epoch =strptime("SLA Time","%Y-%m-%d %H:%M:%S")
| eval time_diff_epoch = sla_time_epoch - time
| table "Autosys Job" "Endttime" "SLA Time" time_diff_epoch

[jpolvino]

Are you certain you are getting a row back from your lookup? Check the field "Autosys Job" that is just prior to your lookup. Also for what it's worth, you should consider using field names that don't have spaces so you avoid having to double quote them. Then at the end, you can rename to a more human readable format. This can save a lot of headaches.