topic Re: events not showing in Splunk Search

events not showing

sulaimancds — Wed, 26 Apr 2023 02:37:10 GMT

| tstats summariesonly=true max(_time) as lastTime, count FROM datamodel=Change BY "All_Changes.action", "All_Changes.result_id", "All_Changes.user", "All_Changes.dest" | rename "All_Changes.*" as * | search result_id = 4732 | convert ctime(lastTime) as lastTime

i am running this command , there is output , but i want to see events and know more details , but events not showing

total number of events Complete 590,046 events

Re: events not showing

VatsalJagani — Wed, 26 Apr 2023 05:52:46 GMT

@sulaimancds - tstats command does not search events, as it is built for performance and not for showing events. Use datamodel command instead or a regular search.

| datamodel Change All_Changes search strict_fields=false

Kindly upvote if you find this answer useful!!!

Re: events not showing

sulaimancds — Wed, 26 Apr 2023 06:25:33 GMT

hi please provide me the full command

Re: events not showing

VatsalJagani — Wed, 26 Apr 2023 08:07:38 GMT

@sulaimancds - Try this as a full search and run it in "Verbose mode".

| datamodel Change All_Changes search strict_fields=false | search "All_Changes.result_id"=4732

This will show the events as you asked.

But if you need events as well as the results then do a regular search in "Verbose mode".

index=* tag=change | stats max(_time) as lastTime, count BY action, result_id, user, dest | search result_id = 4732 | convert ctime(lastTime) as lastTime

Kindly accept the answer and upvote if this helps you!!!