Splunk Search

[tpl10082inf63] Field 'total' does not exist in data

sachinbansal
New Member

Hi,
I am using below query. I am getting data but in chart i am getting warning '[tpl10082inf63] Field 'total' does not exist in data'

index=systest sourcetype=vmreport
| rex max_match=1000 "\Name\s\s\s\s\s\s\s:\s\s(?.)<\/TD>\Guest"
| rex max_match=1000 "\Guest\s\s\s\s\s\s:\s\s(?.
)<\/TD>\State"
| rex max_match=1000 "\State\s\s\s\s\s\s:\s\s(?.*)<\/TD>\

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

We do not see the query referring to a field "total".
So maybe is it something coming from a different place ( automatic field extractions, automatic lookups, role search filter ...) ?

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sachinbansal

Can you please share sample event?

0 Karma
Get Updates on the Splunk Community!

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...