Search Job Investigation after search with no results shows "None"?

avoelk — Wed, 07 Dec 2022 15:56:05 GMT

Hello,

the following search

index=index1 message_type=query NOT ([|inputlookup lookup1 | fields ip_address |rename ip_address as dns_request_client_ip]) NOT dns_request_client_ip=127.0.0.1 |stats count by dns_request_client_ip

shows me 23300 matched events and shows me a table in statistics with those results.

but when I try to use tstats (in that case the datamodel Network_Resolution has all the data for index1) it shows me 0 results, even tho when I only search the tstats datamodel with no other things like lookup etc. it gives me 5 million matches but doesn't show me anything in statistics.

also, in job inspector it shows me that the highlighted portion didn't result in any results and the only highlightet part is behind |tstats (in which nothing should be) and it says "NONE |tstats .... " why is this none there? my tstat is as follows:

|tstats count as count from datamodel=Network_Resolution where (message_type=query) by dns_request_client_ip

and then I try to combine it with the rest of the search as stated above via |search:

there must be something logically wrong with my approach, right?

thanks a lot for any help.

Re: Search Job Investigation after search with no results shows "None"?

richgalloway — Wed, 07 Dec 2022 16:42:39 GMT

The where clause of the tstats commands must use field names present in the datamodel, which must include the DM object name. DNS.message_type, for example. I don't see dns_request_client_ip in the Network_Resolution datamodel, however. Using a non-existing field in the by clause will produce zero results.

Re: Search Job Investigation after search with no results shows "None"

avoelk — Wed, 07 Dec 2022 15:01:22 GMT

ah gosh, that must be it. thanks a lot! I'll try it asap 🙂

tnx rich!

topic Re: Search Job Investigation after search with no results shows "None"? in Splunk Search

Search Job Investigation after search with no results shows "None"?

Re: Search Job Investigation after search with no results shows "None"?

Re: Search Job Investigation after search with no results shows "None"