Splunk Search

After setting up several eventtypes with the same tag, why am I getting a NULL eventtype when trying to use timechart?

chriscranford
New Member

Hi all!

I've set up several eventtypes with the same tag. I'm now trying to use timechart but getting unexpected NULL eventtype.

Search example:

host="production" tag="mytag" | timechart span=1w count by eventtype

Somehow this is coming back with a NULL eventtype, despite the search alone returning as expected. All of the eventtypes start with the same word (e.g. "myevent_100", "myevent_101", etc.) so I also tried this and get the same strange NULL on the timechart:

host="production" eventtype="myevent*" | timechart span=1w count by eventtype

What am I missing here? Thanks!

0 Karma

snoobzilla
Builder

Problem here is that eventtype can be multivalued and is otherwise "special" as a knowledge object. You can try doing

host="production" eventtype="myevent*"
| eval SingleValueEventtype=mvindex(0, eventtype)
| timechart span=1w count by SingleValueEventtype

I wrestled with this one a long time ago. Lookups by eventtype are also very problematic.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...