Deployment Architecture

Why does the Cluster search command return 0 events?

thisissplunk
Builder

When I use the cluster command in its simplest form to a complicated query, it returns 0 results. I have no idea how to go about troubleshooting this. The index and sourcetype I'm using definitely has plenty of events in it. Nothing I've tried has worked.

How do I tell if the command is still a thing? How do I tell if it's running in my query but just not returning anything... etc.

Tags (2)
0 Karma
1 Solution

thisissplunk
Builder

I have no idea what was happening, but the same exact query is returning results now.

View solution in original post

0 Karma

thisissplunk
Builder

I have no idea what was happening, but the same exact query is returning results now.

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...