Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Why do I have events that show up ok in the last 24 hours, but not in the past 7 days?

$
0
0
I have a search that works perfectly fine and works well for the last 24 hours. When I try to aggregate the data from the last week, 0 results show up host= my_host | fillnull Example value="" | transaction ScenarioRunId | eval FeatureRunId=mvfilter(FeatureRunId!="null") | Join type=inner FeatureRunId [ SEARCH msg.type=feature File = "$DIR$*" | FIELDS FeatureRunId, File] | dedup Text, File, Example sortby -_time | table Text, Example, Status When I click the last 24 hours `Statistics(23)` When I click the last 7 days `Statistics(0)`

Viewing all articles
Browse latest Browse all 47296

Trending Articles