Splunk Search

Why does my timechart search return "No results found"?

a212830
Champion

Hi,

I have a search where Splunk data is joined with a lookup, and I need a timechart on one of the fields provided by the lookup, but I can't get it to work. Not sure what I'm doing wrong...

Here's the search, which works fine.

index=network sourcetype=ive_syslog host=*eraweb* "Primary authentication successful" | fields time, CORP_ID, host |dedup CORP_ID |table CORP_ID, host, time  |eval location=case(host LIKE "%mmk%", "MMK", host LIKE "%rtd%", "RTP", host LIKE "%oma%", "OMA", host LIKE "%", "Others")|lookup tinypeople.csv CORP_ID  OUTPUT  CORP_ID, DISPLAY_NAME, COMPLETE_NAME, COST_CENTER, BUSINESS_UNIT_CODE, BUSINESS_GROUP_CODE, BUSINESS_GROUP_DESC, POSN_LOC_LOCALITY_CODE, BUSINESS_UNIT_DESC

I tried adding a |timechart count by BUSINESS_UNIT_DESC, but it comes back with "No Results found". What am I doing wrong?

0 Karma

Anantha123
Communicator

try this

index=network sourcetype=ive_syslog host=*eraweb* "Primary authentication successful"
| lookup tinypeople.csv CORP_ID
| timechart count by BUSINESS_UNIT_DESC

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Is the time field not in the final results? That one is critical for the timechart to work.

Also, if you do dedup and then table, consider replacing both with a stats command for improved performance.

0 Karma

Richfez
SplunkTrust
SplunkTrust

Can you confirm that in your search (without timechart) that the field "BUSINESS_UNIT_DESC" actually has data in it?

0 Karma

a212830
Champion

Yes, it returns a table of information, and that field is populated.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Can you try this ?

your search |eval BUSINESS_UNIT_DESC=coalesce(BUSINESS_UNIT_DESC,"NOT FOUND"|timechart count by BUSINESS_UNIT_DESC
Happy Splunking!
0 Karma

a212830
Champion

Got it. Never mind.. Thanks!

0 Karma

ppablo
Retired

Hi @a212830

Can you confirm what the issue was and share the answer below for other users to resolve this post?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

out of curiosity , what was the problem?

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...