Hello everyone.
I have a dashboard with embedded queries that has stopped working since my update from 8.1 to 8.2.1.
The query is as follows:
host=sftpserver* source=/var/log/messages close bytes read written | rex "close \"(?<filename>.[^\"]+)" |rex "written (?<writebytes>\w+)" | rex "read (?<readbytes>\w+)" | eval rfile=if(readbytes == 0, null(), filename) | eval wfile=if(writebytes == 0, null(), filename) |eval writemb=(writebytes/1024/1024) | eval readmb=(readbytes/1024/1024) | eval readmb=round(readmb,2) | eval writemb=round(writemb,2) |eval datetimestr=strftime(_time, "%Y-%m-%d %H:%M")| chart count(rfile)
The query just gives a count of the number of files download from my SFTP server.
Since the update, the dashboard that includes this query (and several others) now only shows data from before the time when Splunk was updated.
Copying the query from the dashboard into a search, I can get the query to work in verbose mode but neither Fast nor Smart mode will return any results.
