topic Re: "This search uses deprecated 'stats' command syntax." in Splunk Search

"This search uses deprecated 'stats' command syntax."

mitag — Tue, 11 Aug 2020 15:55:12 GMT

Getting this informational message when running "stats count" commands:

This search uses deprecated 'stats' command syntax. This syntax implicitly translates '<function>' or '<function>()' to '<function>(*)', except for cases where the function is 'count'. Use '<function>(*)' instead.

I don't understand it. What am I doing wrong and what should I be doing instead? A sample of the stats command generating the message above:

| stats sparkline count(Destination) AS sessions by Destination_URL, Destination_userID

Thanks!

Re: "This search uses deprecated 'stats' command syntax."

richgalloway — Tue, 11 Aug 2020 16:34:59 GMT

The sparkline argument should be a function, perhaps

| stats sparkline(count(Destination)) AS sessions by Destination_URL, Destination_userID

Re: "This search uses deprecated 'stats' command syntax."

mitag — Tue, 11 Aug 2020 22:54:54 GMT

That removes the session count field though. This one:

Re: "This search uses deprecated 'stats' command syntax."

richgalloway — Wed, 12 Aug 2020 00:12:34 GMT

So add it back in.

| stats sparkline(count(Destination)), count(Destination)) AS sessions by Destination_URL, Destination_userID

Re: "This search uses deprecated 'stats' command syntax."

mitag — Wed, 12 Aug 2020 00:15:01 GMT

I did. 🙂 But doesn't that means "stats" is then run twice for the same dataset, thus unnecessarily increasing the "cost" of the search? (And somewhat clogging it, making it just a teeny bit less readable?)

Re: "This search uses deprecated 'stats' command syntax."

richgalloway — Wed, 12 Aug 2020 11:54:20 GMT

Yes, but that's the only way to get what you want.

Re: "This search uses deprecated 'stats' command syntax."

mitag — Wed, 12 Aug 2020 20:10:56 GMT

@richgalloway just in case you have the bandwidth for a follow up question...

Here is the sample search in "Add sparklines to search results" Splunk KB article for 8.0.5 (latest) release:

index=_internal | chart sparkline count by sourcetype

It produces the same dreaded "deprecated syntax" notification in my 8.04.1 instance.

Questions:

How would you modify this search to remove the notification yet retain both the sparkline and the "count" field?
Would it make sense to try asking a new question, something like "what are Splunk recommendations on using non-deprecated 'stats' command syntax that is as performant as the deprecated one?"

Re: "This search uses deprecated 'stats' command syntax."

thambisetty — Wed, 12 Aug 2020 19:54:29 GMT

index=_internal | chart sparkline count by sourcetype

https://docs.splunk.com/Documentation/Splunk/8.0.5/Search/Addsparklinestosearchresults

Re: "This search uses deprecated 'stats' command syntax."

mitag — Wed, 12 Aug 2020 20:11:57 GMT

Typo on my part (grabbed the wrong SPL from the docs). Corrected. The solution you're proposing is the one with the problem and the one I have questions about.

Re: "This search uses deprecated 'stats' command syntax."

richgalloway — Thu, 13 Aug 2020 13:13:49 GMT

That command works without error on my 8.0.4 instance.
How do you know which syntax is more performant? Does the Job Inspector show a noticeable difference?

Re: "This search uses deprecated 'stats' command syntax."

mitag — Thu, 13 Aug 2020 15:12:18 GMT

> That command works without error on my 8.0.4 instance.

This gives me the green "deprecated syntax" informational message in 8.04.1, 8.05:

index=_internal | chart sparkline count by sourcetype

> How do you know which syntax is more performant? Does the Job Inspector show a noticeable difference?

About 10-20% faster for the "deprecated" one vs. the one you came up with, with two "count" functions.

| stats sparkline(count(Destination)), count(Destination))

Re: "This search uses deprecated 'stats' command syntax."

richgalloway — Thu, 13 Aug 2020 18:04:21 GMT

As they say, you can't have your cake and eat it, too. Either use the deprecated syntax (which could be supported indefinitely for all we know) or use the new syntax and suffer the (minimal) performance implications.
Oh, and submit feedback on the docs page that uses that syntax so they can correct it.

Re: "This search uses deprecated 'stats' command syntax."

mitag — Wed, 19 Aug 2020 00:12:02 GMT

Turns out it's a bug - the "deprecated syntax" notification is not supposed to happen - thanks @mattness for the post!

"Turns out this particular example is a bug. Splunk 8.0.0 through 8.0.6 generates this "info message" when you use sparkline without an argument (such as sparkline(count) or sparkline(count(cpu)). This isn't supposed to happen. The bug is fixed in upcoming versions of Splunk."