Splunk Search

Why am I getting "No matching events found" on the next page when I click on _time in my search results?

lksridhar
Explorer

Hi Everyone,

I have written the search below to display the information about integer and seconds value and other data. It is displaying all the information on the dashboard, but when I click on the _time field, it is not displaying any data on the next page, and I'm getting "No matching events found"could you please any help me on this?

Search:

index=web_usit source="/weblogs/com9072/clusterB-02/resolvetransactionservices.log" TransactionSearchController OR TransactionSearchDelegateImpl | dedup _raw | transaction startswith="Entered Search Transaction(s)" endswith="Transaction Search Query [] Time" | rex field=_raw ", Integer=\[(?\d+)\]" | rex "=\s+(?[\d\.]+)" | rename seconds AS total_search_time | rename Integer AS Result_Count | table _time,  total_search_time, Resuld_Count,

data like

0 Karma

cmerriman
Super Champion

My guess is that it has to do with the transaction. When you click on _time, what does the query change to?

0 Karma

lksridhar
Explorer

I'm trying to do the transaction between the events and if we click on _time row it should show the group of event in next page.

Raw data:

Dec 06, 2016 10:02:04 AM CST INFO (TransactionSearchController.java:48) - String=[Entered Search Transaction(s)]
Dec 06, 2016 10:02:05 AM CST INFO (TransactionSearchDelegateImpl.java:45) - String=[Initiating Transaction search for Query], String=[test567]
Dec 06, 2016 10:02:05 AM CST INFO (TransactionSearchDelegateImpl.java:48) - transaction search without timeout
Dec 06, 2016 10:02:39 AM CST INFO (TransactionSearchDelegateImpl.java:54) - String=[Transaction Search Results. Transactions Count Is], String=[test567], Integer=[60]
Dec 06, 2016 10:02:39 AM CST INFO (TransactionSearchDelegateImpl.java:55) - Transaction Search Query [test567] Time (in seconds) = 34.267

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...