Splunk Search

There are plenty of matching events, but why are summary index results not generated?

billycote
Path Finder

Hi Folks,

I have the following search:

index=snaptor sourcetype=IDCResponseTimes requestoption!=*PercentBarDataRequestOption* (Connection_Type=HistTick OR Connection_Type=HistBar) | fields Connection_Type Status Number_of_bars Response_Time | eval Num_bars = case(Status =="NO_DATA",0, Status !="NO_DATA",Number_of_bars) | eval bar_type = case(Connection_Type=="HistTick", "intraday", Connection_Type=="HistBar", "end-of-day") | eval response_size = case(bar_type=="intraday", case(Num_bars <= 600, "small", Num_bars <= 1500, "medium", Num_bars <= 2500, "large", Num_bars > 2500, "excessive!"), bar_type=="end-of-day", case(Num_bars <= 900, "small", Num_bars <= 2000, "medium", Num_bars <= 2500, "large", Num_bars > 2500, "excessive!")) | bin _time span=1d | stats count as request_count, avg(Response_Time) as resptime_avg, exactperc99(Response_Time) AS resptime_p99, exactperc99.9(Response_Time) AS resptime_p999, exactperc99.99(Response_Time) as resptime_p9999, max(Response_Time) AS resptime_max by _time bar_type, response_size | eval resptime_avg=round(resptime_avg,1)

This works fine when I run it on the search line. However, when I try to put it into a summary index, no results are generated. I looked at the job with the inspector and I see this:

This search has completed and found 8,502,740 matching events. However, the transforming commands in the highlighted portion of the following search: 

| stats count as request_count, avg(Response_Time) as resptime_avg, exactperc99(Response_Time) AS resptime_p99, exactperc99.9(Response_Time) AS resptime_p999, exactperc99.99(Response_Time) as resptime_p9999, max(Response_Time) AS resptime_max by _time bar_type, response_size | eval resptime_avg=round(resptime_avg,1) | summaryindex spool=t uselb=t addtime=t index="si_idcsla" file="RMD5ef94608677008700_1443652997.stash_new" name="IdcSla_RespTime_Prod" marker="report=\"ResponseTime\""

 over the time range:

4/5/16 7:00:00.000 AM – 4/5/16 8:00:00.000 PM

generated no results. Possible solutions are to:

    check the syntax of the commands
    verify that the fields expected by the report commands are present in the events

I've checked the syntax and it's working just fine, but not generating results to the summary index.

Any idea?

0 Karma

billycote
Path Finder

I saved the exact same query into a different report and it started writing to a summary index. I'm very confused why I had to do this.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try (changed fields to table and added _time)

 index=snaptor sourcetype=IDCResponseTimes requestoption!=*PercentBarDataRequestOption* (Connection_Type=HistTick OR Connection_Type=HistBar) | table _time Connection_Type Status Number_of_bars Response_Time | eval Num_bars = case(Status =="NO_DATA",0, Status !="NO_DATA",Number_of_bars) | eval bar_type = case(Connection_Type=="HistTick", "intraday", Connection_Type=="HistBar", "end-of-day") | eval response_size = case(bar_type=="intraday", case(Num_bars <= 600, "small", Num_bars <= 1500, "medium", Num_bars <= 2500, "large", Num_bars > 2500, "excessive!"), bar_type=="end-of-day", case(Num_bars <= 900, "small", Num_bars <= 2000, "medium", Num_bars <= 2500, "large", Num_bars > 2500, "excessive!")) | bin _time span=1d | stats count as request_count, avg(Response_Time) as resptime_avg, exactperc99(Response_Time) AS resptime_p99, exactperc99.9(Response_Time) AS resptime_p999, exactperc99.99(Response_Time) as resptime_p9999, max(Response_Time) AS resptime_max by _time bar_type, response_size | eval resptime_avg=round(resptime_avg,1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...