My Splunk Version is 6.5.1 and I get this error while I try to run my saved search.
When I try to copy the search into a new search window and try running it, it works fine. I am stuck on this issue from the last couple of days . Any help would be great.
My Saved search :
index="entitydata_1_2_*" ( kpr=RKT_Call_Finished OR kpr=LKT_Call_Setup OR kpr=MRDF_CallSetup)
|foreach * [rex field=<> mode=sed "s/{|}//g"]
|eval SetupFinishTime = if (kpr="RKT_Call_Finished",creationDate , null)
|eval EntitiesAttempted =EntitiesCount
|transaction GlobalID maxspan=10000m
|eval InitialDirection=if (kpr="LKT_Call_Setup" ,InitialDirection,null)
|eval LKTCallSetupExists = if (kpr="LKT_Call_Setup" ,"YES","NO")
|fields kpr,GlobalID, SetupFinishTime ,EntityURI,EntityNum,FinalEntityUri,FinalResult,EntitiesAttempted ,InitialDirection, LKTCallSetupExists,
|rename EntityNum as InitialEntityNum
|eval entNum = InitialEntityNum |join type=Left entNum [| search index=entity_sum_1_2_* key=tcds_1_2_entity_feed | search [|inputlookup customer.csv | search [| search index="entitydata_1_2_*" kpr=RKT_Call_Finished | rename source as Source | return Source] | rename Customer as customer | return customer]| rename entityName as name |fields entNum , name,tfdid,entityID]
| table kpr,GlobalID, SetupFinishTime ,EntityURI,EntityNum,FinalEntityUri,FinalResult,EntitiesAttempted ,InitialDirection,LKTCallSetupExists,entNum , name,tfdid,entityID
↧