Ive seen this behavior in many deployments. In the Splunk on Splunk errors page, I select 'Group Similar Events' and the cluster_count does not show up. why?
Since 6.0.3, the cluster search command no longer returns the cluster_count by default.
eg. showcount = false
Prior to 6.0.3, the default of showcount = true
Since displaying the count could have a performance impact, from 6.0.3+ a user can pass showcount = true
to the cluster command to return the cluster_count.
eg. index=_internal | cluster showcount=true | table cluster_count, _raw
SPL-83560 updates the documentation for the cluster command default showcount option
This is caused by a bug with Splunk Enterprise (reference: SPL-83560) which will be fixed in a future maintenance release.
Yes, the issue is indeed with the "cluster" command.
Does this also explain why the cluster_count field added to events by the cluster commmand aren't showing up anymore as well? Only cluster_label is showing up now for me.