Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

how to fix error "The external search command 'xmlkv' did not return events in descending time order, as expected"?

$
0
0
I am getting error as ** "The external search command 'xmlkv' did not return events in descending time order, as expected"** along with my search results. Dashboard functionality works as expected and search results are getting displayed. Please find the code snippet for one panel for reference and suggest. There are 6 panels altogether with different queries.
source="log.2020-05-08" | rex field=_raw "((?(\w*))\s(?(\d+))\s((([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]))\s(?(\d{8}\s\d{6}))\s(?([\w\s.:,/()]*)))" | rex field=number "(?([\d]*))/\d" | xmlkv maxinputs=10000 | rename "SBT-type" as Mtracktype "SBT-exception-code" as MTrackECode | eval LogTimeStamp=strftime(strptime(TimeStamp,"%Y%m%d%H%M%S"),"%m/%d/%Y %H:%M:%S %p") | sort -LogTimeStamp
*
Results Export search (SBTnumber=$SBTNo$ OR Number=$SBTNo$ OR type=$SBTNo$ OR AWB=$SBTNo$) | table LogType LogTimeStamp Msg SBTtype SBTnumber$job.sid$1

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>