I have downloaded the cloudflare app in my splunk and had set the index as "cf_index". However, when i open the app , it says zero results. This is the search query of a field
| tstats sum(cloudflare.bytes_out) as total_bandwidth from datamodel=cloudflare.cloudflare where cloudflare.ClientCountry="*" cloudflare.ClientDeviceType="*" cloudflare.dest_ip="*" cloudflare.dest_host="*" cloudflare.uri_path="*" cloudflare.http_user_agent="*" cloudflare.status="*" cloudflare.src_ip="*" cloudflare.OriginResponseStatus="*" cloudflare.RayID="*" cloudflare.WorkerSubrequest="*" cloudflare.http_method="*"
| eval total_bandwidth=round(total_bandwidth/1000000,2)
no results were found for this query
I would like to know there were no results found ?.
if i search for my index "cf_index" in search, it shows the data.
how to verify if cloudflare is referring to my index or trying to get data from my index?
