Reporting

Report is missing first column of data

baegoon
Explorer

I have three reports that are based on transactions. The transactions are similar they report different process states. One of my reports does not show the first column of data. For instance I have "HelpdeskAgent", "RequestType", "Request Last Name", "Request Firstname", Request ID, Request Duration all in a table and the Helpdeskagent does not have the information in the column. I can run the report or goto the dashboard for the search in my search head and the HelpDeskAgent column is there and all three reports work. If I run the report manually all the columns populate. However when I export to PDF the column is missing for that report. This happens for the automated PDF export report as well. I don't thin it's a search term issue. However it could be a formatting issue??
Should I submit a support ticket for this?

Here is the search:

eventtype=IDMlogs  workflowstatus="Workflow_Started" OR workflowstatus="Workflow_Ended" OR workflowstatus="Workflow_Error" OR workflowstatus="User_Message" 
| transaction processid startswith=eval(workflowstatus="Workflow_Started") endswith=eval(workflowstatus="Workflow_Ended")
| eval duration = tostring(duration,"duration")
| sort -duration
| table helpdeskagent employeeType workforceID workforceIDGen surname givenName duration
| rename duration as "Time in Process", helpdeskagent as " Agent Assigned", surname as "Requestor Last Name", givenName as "Requestor First Name"
0 Karma

woodcock
Esteemed Legend

It doesn't matter what the search is: if it generates a table and those tabular results are different when you export as PDF, you need to open a support case.

0 Karma

baegoon
Explorer

Thanks! I will open one now.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

I notice that you have three different capitalizations for helpdeskagent in your question. Splunk is always case-sensitive for field names.

To start with, go back and make sure that you have spelled and capitalized the word exactly the way it is in the data.

Once you have verified that, we can try other debug methods.

0 Karma

baegoon
Explorer

In my intro to the problem please treat that as Agent Assigned t. But please look at the search rather than my intro of the problem in regards to renaming helpdeskagent. This is why I included the search. Also helpdeskagent is a rex that was created using erex.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...