topic Re: Why does it say there are events but then it says "No results found"? in Splunk Search

Why does it say there are events but then it says "No results found"?

frizzoS3 — Thu, 21 Sep 2017 19:17:17 GMT

After running a search, I have the below results:
112,471 events (9/20/17 2:00:00.000 PM to 9/21/17 2:10:07.000 PM

But when I click on the Events tab, I see this: No results found. even though the search is in verbose mode.

How can I review those 112,471 events?

Re: Why does it say there are events but then it says "No results found"?

somesoni2 — Thu, 21 Sep 2017 19:38:30 GMT

What's your search?

Re: Why does it say there are events but then it says "No results found"?

frizzoS3 — Tue, 29 Sep 2020 15:54:27 GMT

| tstats summariesonly max(_time) as _time,values(All_Traffic.src_category) as src_category,values(All_Traffic.dest_category) as dest_category,count from datamodel=Network_Traffic.All_Traffic by All_Traffic.src,All_Traffic.dest,All_Traffic.transport,All_Traffic.dest_port | drop_dm_object_name("All_Traffic") | is_traffic_prohibited(dest_port) | search (is_prohibited!="false" OR is_secure!="unknown") | fields _time,src,src_category,dest,dest_category,transport,dest_port,is_prohibited,is_secure

Re: Why does it say there are events but then it says "No results found"?

harsmarvania57 — Thu, 28 Sep 2017 09:53:08 GMT

tstats will not display events , it will disply your output in statistics only.

Re: Why does it say there are events but then it says "No results found"?

bdmeyersc — Tue, 14 May 2019 11:53:34 GMT

I'm surprised that no one answered this question since 2017. (I'm going to be asking the same one, phrased a bit differently, if I can't find an answer here)

Re: Why does it say there are events but then it says "No results found"?

louismai — Wed, 30 Sep 2020 00:43:11 GMT

I have the same issue. The search string run in Verbose mode in Search app, but it didn't run in dashboard. s_hostname is seach-time field extraction.
index=cisco_wsa sourcetype="cisco:wsa:w3c" s_hostname="*"| top limit=20 s_hostname

Re: Why does it say there are events but then it says "No results found"?

DavidHourani — Wed, 30 Sep 2020 00:41:17 GMT

Hi @louismai, run index=cisco_wsa sourcetype="cisco:wsa:w3c" s_hostname="*"first and see if you get any s_hostname. The number of results is simply the number of events that were returned, doesn't mean that they have a valid s_hostname value.

Re: Why does it say there are events but then it says "No results found"?

DavidHourani — Tue, 28 May 2019 07:51:01 GMT

answer is in the comments ^^ " tstats will not display events , it will display your output in statistics only. "

Re: Why does it say there are events but then it says "No results found"?

Ash — Fri, 07 Oct 2022 08:36:55 GMT

What should be modified in the search to display the events in Verbose mode