topic Ingest Actions sample data missing for WinEventLog sourcetype in Getting Data In

Ingest Actions sample data missing for WinEventLog sourcetype

cdavidsonbp — Mon, 08 Apr 2024 19:08:03 GMT

Hello,

When I try to sample data for the WinEventLog sourcetype in Ingest Actions I get an error message:
"No results found. Try expanding the time range."

Expanding the query I see Splunk using the following and manually running this query does not return any results either:

index=* OR index=_* sourcetype="WinEventLog" | where sourcetype="WinEventLog" | head 100

However, I do get results when I manually run either:

index=* OR index=_* | where sourcetype="WinEventLog" | head 100

index=* OR index=_* sourcetype="WinEventLog" | head 100

Can someone please explain why the first query may not be working? Is there a different way I should be working with the WinEventLog sourcetype in Ingest Actions? Thanks in advance for your help!

Re: Ingest Actions sample data missing for WinEventLog sourcetype

livehybrid — Sat, 06 Jan 2024 22:58:50 GMT

Do you have any sourcetype renaming taking place or anything that might be changing the value of the sourcetype field?

I am wondering if the data is not indexed with sourcetype WinEventLog but as something else (hence picked up when not specifying the sourcetype) and then once the events are being searched the sourcetype is changed to WinEventLog?

Might be worth a check to start with, but please let me know how you get on as happy to help further if I can!

Re: Ingest Actions sample data missing for WinEventLog sourcetype

PickleRick — Sun, 07 Jan 2024 20:33:48 GMT

It does seem like a bug in optimizer.

I did a search

index=winevents sourcetype=WinEventLog
| where sourcetype="WinEventLog"

It did not return any results - as was in your case.

But when I opened the job inspector it showed me the search optimized to

search (index="winevents" sourcetype=WinEventLog sourcetype=CASE("WinEventLog"))

Re: Ingest Actions sample data missing for WinEventLog sourcetype

syburcon — Mon, 08 Apr 2024 17:35:22 GMT

Hello. How do i determine what the original source name may be?