Reporting

Report is missing first column of data

baegoon
Explorer

I have three reports that are based on transactions. The transactions are similar they report different process states. One of my reports does not show the first column of data. For instance I have "HelpdeskAgent", "RequestType", "Request Last Name", "Request Firstname", Request ID, Request Duration all in a table and the Helpdeskagent does not have the information in the column. I can run the report or goto the dashboard for the search in my search head and the HelpDeskAgent column is there and all three reports work. If I run the report manually all the columns populate. However when I export to PDF the column is missing for that report. This happens for the automated PDF export report as well. I don't thin it's a search term issue. However it could be a formatting issue??
Should I submit a support ticket for this?

Here is the search:

eventtype=IDMlogs  workflowstatus="Workflow_Started" OR workflowstatus="Workflow_Ended" OR workflowstatus="Workflow_Error" OR workflowstatus="User_Message" 
| transaction processid startswith=eval(workflowstatus="Workflow_Started") endswith=eval(workflowstatus="Workflow_Ended")
| eval duration = tostring(duration,"duration")
| sort -duration
| table helpdeskagent employeeType workforceID workforceIDGen surname givenName duration
| rename duration as "Time in Process", helpdeskagent as " Agent Assigned", surname as "Requestor Last Name", givenName as "Requestor First Name"
0 Karma

woodcock
Esteemed Legend

It doesn't matter what the search is: if it generates a table and those tabular results are different when you export as PDF, you need to open a support case.

0 Karma

baegoon
Explorer

Thanks! I will open one now.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

I notice that you have three different capitalizations for helpdeskagent in your question. Splunk is always case-sensitive for field names.

To start with, go back and make sure that you have spelled and capitalized the word exactly the way it is in the data.

Once you have verified that, we can try other debug methods.

0 Karma

baegoon
Explorer

In my intro to the problem please treat that as Agent Assigned t. But please look at the search rather than my intro of the problem in regards to renaming helpdeskagent. This is why I included the search. Also helpdeskagent is a rex that was created using erex.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...