Splunk Search

Query not displaying any events

pratapa
Explorer

User complained that following query is not displaying any events.

index=main sourcetype=wms_oracle_sessions | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program | search warehouse=wk | stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program

what could be the problem in the above query.

0 Karma

woodcock
Esteemed Legend

Try this:

index="main" AND sourcetype="wms_oracle_sessions" AND warehouse="wk"
| bucket _time span=5m
| stats count AS sessions BY _time warehouse machine program
| stats sum(sessions) AS psessions BY _time program
| stats avg(psessions) BY program
0 Karma

to4kawa
Ultra Champion

Query not displaying any events
Where?
1st stats?
search?
2nd stats?
last timechart?

SPL runs in order.
Please run the query line by line.
You can find where the problem is.
Good luck.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pratapa,
I see that you filter your results for warehouse=wk that's one of the BY clause fields in the first stats command, it's always better to filter in the main search so you don't need it in the first stats, in addition the clause machine isn't used so you don't need the two stats commands.
so you could simplify your search in this way:

index=main sourcetype=wms_oracle_sessions warehouse=wk
| timechart span=5m count by program

Ciao.
Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One possibility is there are no events to display.
Another possibility is one of the fields in the by clause of stats is null. That will cause stats to return no results.

---
If this reply helps you, Karma would be appreciated.
0 Karma

pratapa
Explorer

Thanks for your reply.

We tried modifying the query as follows but No results found.

index=main sourcetype=wms_oracle_sessions warehouse=wk | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program| stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program

We tried the below query as well, but no results found.

index=main sourcetype=wms_oracle_sessions warehouse=wk | timechart span=5m count by program

Even when we try the below ones, no results found.

index=main sourcetype=wms_oracle_sessions warehouse=wk

index=main sourcetype=wms_oracle_sessions

sourcetype=wms_oracle_sessions

It seems source type wms_oracle_sessions does not exist. Please suggest what can be done.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Searching only for sourcetype may not work, depending on your default index(es). Try index=* sourcetype=wms_oracle_sessions. If that returns nothing then you need to investigate why you are not receiving any data of that source type.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...