deprecated 'stats' command syntax notification on a sample Splunk search

mitag — Thu, 13 Aug 2020 17:00:04 GMT

Running a sample search suggested by "Add sparklines to search results" in Splunk Documentation for the latest version (8.0.5 as of this writing):

index=_internal | chart sparkline count by sourcetype

... results in the following "green" job notification:

This search uses deprecated 'stats' command syntax. This syntax implicitly translates '<function>' or '<function>()' to '<function>(*)', except for cases where the function is 'count'. Use '<function>(*)' instead.

(This is reproduced in Splunk Enterprise versions 8.02, 8.04.1, 8.05.)

Questions:

Does this happen for you, too (in Splunk Enterprise versions 8.x)?
Why does Splunk use deprecated syntax in their docs? (Is there a good reason for it, or is this simply a benign case of a slightly stale documentation that's just not worth of an update?)
How would one modify the above search to (1) eliminate the "deprecated syntax" message while (2) retaining both the sparkline and the count fields, and optionally, (3) making it at least as performant as the "deprecated" one?

Thank you!

(This question is a more generic follow up to "This search uses deprecated 'stats' command syntax." that was answered by @richgalloway (thank you).)

Re: deprecated 'stats' command syntax notification on a sample Splunk search

mattness — Tue, 18 Aug 2020 23:06:57 GMT

Turns out this particular example is a bug. Splunk 8.0.0 through 8.0.6 generates this "info message" when you use sparkline without an argument (such as sparkline(count) or sparkline(count(cpu)). This isn't supposed to happen. The bug is fixed in upcoming versions of Splunk.

As for supporting deprecated syntax - well, sometimes we do that for backwards-compatibility, when people are upgrading from older versions of the product.

topic Re: deprecated 'stats' command syntax notification on a sample Splunk search in Splunk Search

deprecated 'stats' command syntax notification on a sample Splunk search

Re: deprecated 'stats' command syntax notification on a sample Splunk search