Hi Splunkers, i have been working on a dashboard for that I need the data for last 7 months from jan 2024 to till date when i was searching for the logs it was only showing for the last 3 months data i.e., from 10, jun to till date and gradually all the logs are disappearing is there any way to fix this... i tried this query  | tstats earliest(_time) as first, latest(_time) as last where index=foo | fieldformat first=strftime(first,"%c") | fieldformat last=strftime(last,"%c") the result shows index="my-index"                 first                                                       last  Mon Jun 10 04:19:23 2024     Tue Aug 27 07:50:04 2024 ... View more

Hello Splunkers, I have the following query returning the search results, index="demo1" | search "metrics.job.overall_status"="FAILED" OR "metrics.job.overall_status"="PASSED" metrics.app="*" | eval timestamp=strftime(floor('metrics.job.end_ts'), "%Y-%m-%d %H:%M:%S") | sort 0 metrics.app timestamp | streamstats current=f last(metrics.job.overall_status) as prev_status last(timestamp) as prev_timestamp by metrics.app | fillnull value="NONE" prev_status | fillnull value="NONE" prev_timestamp | eval failed_timestamp=if(metrics.job.overall_status="FAILED" AND (prev_status="NONE" OR prev_status!="FAILED"), timestamp, null()) | table metrics.app, metrics.job.overall_status, prev_status, timestamp, prev_timestamp,failed_timestamp The result is null in every entry. What is wrong? even though there are FAILED status with the above specified conditions but the failed_timestamp results are null() can anyone please share how to correct this... ... View more