Activity Feed
- Karma Re: Query no Longer Returning Correct Results for bowesmana. 12-05-2024 07:22 AM
- Karma Re: Query no Longer Returning Correct Results for gcusello. 12-03-2024 07:28 AM
- Got Karma for Re: Query no Longer Returning Correct Results. 12-02-2024 11:48 PM
- Posted Re: Query no Longer Returning Correct Results on Splunk Search. 12-02-2024 11:47 AM
- Posted Re: Query no Longer Returning Correct Results on Splunk Search. 11-29-2024 09:44 AM
- Posted Re: Query no Longer Returning Correct Results on Splunk Search. 11-26-2024 09:13 AM
- Karma Re: Query no Longer Returning Correct Results for gcusello. 11-26-2024 09:02 AM
- Posted Query no Longer Returning Correct Results on Splunk Search. 11-26-2024 08:47 AM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
0 |
12-02-2024
11:47 AM
1 Karma
@gcusello I'm not entirely sure what you're referring to to be honest. Our subsearch is well under 50k results so that shouldn't be the issue. But I appreciate you trying to assist. I'll see if I can puzzle it out.
... View more
11-29-2024
09:44 AM
@gcusello Yeah it's odd. Neither of those 2 return any stats results (I checked to make sure I copied the whole query, updated as appropriate for indexes etc.) The original query is only giving 20 entries under stats (and far less results) which used to work so that's also weird. What we've been doing is something along the lines of this: index=test OR index=test2 source="insertpath" ErrorCodesResponse=TestError TraceId=* | fields TraceId | append [ search index=test "Test SKU" AND @mt !="TestAsync: Request(Test SKU: )*" | fields TraceId, @t, @mt, RequestPath | where isnotnull('@t') AND isnotnull('@mt') AND match('@mt', "Test SKU: *") ] | eval date=strftime(strptime('@t', "%Y-%m-%dT%H:%M:%S.%6N%Z"), "%Y-%m-%d"), time=strftime(strptime('@t', "%Y-%m-%dT%H:%M:%S.%6N%Z"), "%H:%M") | stats values(date) as date values(time) as time values(@mt) as message values(RequestPath) as Path by TraceId | where isnotnull(date) AND isnotnull(time) AND isnotnull(message) | table date, time, TraceId, message, Path This seems to work better than our old search but I'd prefer to try and figure out yours as it's not using those appended searches.
... View more
11-26-2024
09:13 AM
@gcusello Thanks for replying! That pull results, but it's doesn't populate anything in the statistic tab, which is our main issue (old query shows 20, alternate one that we don't really want to use shows 1700). The total results are around 38k as well so we're not going over, but definitely I think correcting the search issue is a good idea. Any ideas about the statistics piece?
... View more
11-26-2024
08:47 AM
Hello,
We have a query for an alert that was working prior, but is no longer returning the correct results. We haven't changed anything on our instance, so I'm not sure as to what would be the cause. Query is below (I blanked out the index names, etc of course). I tested it with an different query which is returning the expected results, but I'd like to figure out what's going on with this one.
index=testindex OR index=testindex2 source="insertpath" ErrorCodesResponse=PlanInvalid
| search TraceId=*
| stats values(TraceId) as TraceId
| mvexpand TraceId
| join type=inner TraceId
[search index=test ("Test SKU")
| fields TraceId,@t,@mt,RequestPath]
| eval date=strftime(strptime('@t', "%Y-%m-%dT%H:%M:%S.%6N%Z"), "%Y-%m-%d"), time=strftime(strptime('@t', "%Y-%m-%dT%H:%M:%S.%6N%Z"), "%H:%M")
| table time, date, TraceId, @MT,RequestPath
... View more