Getting Data In

Ingest Actions sample data missing for WinEventLog sourcetype

cdavidsonbp
Observer

Hello,

When I try to sample data for the WinEventLog sourcetype in Ingest Actions I get an error message:
     "No results found. Try expanding the time range."

Expanding the query I see Splunk using the following and manually running this query does not return any results either:
     

index=* OR index=_* sourcetype="WinEventLog"
     | where sourcetype="WinEventLog"
     | head 100

 

However, I do get results when I manually run either:
   

  index=* OR index=_*
     | where sourcetype="WinEventLog"
     | head 100

            OR

    

 index=* OR index=_* sourcetype="WinEventLog"
     | head 100

Can someone please explain why the first query may not be working? Is there a different way I should be working with the WinEventLog sourcetype in Ingest Actions? Thanks in advance for your help!

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It does seem like a bug in optimizer.

I did a search

index=winevents sourcetype=WinEventLog
| where sourcetype="WinEventLog"

It did not return any results - as was in your case.

But when I opened the job inspector it showed me the search optimized to

search (index="winevents" sourcetype=WinEventLog sourcetype=CASE("WinEventLog"))

 

0 Karma

livehybrid
Super Champion

Do you have any sourcetype renaming taking place or anything that might be changing the value of the sourcetype field?

I am wondering if the data is not indexed with sourcetype WinEventLog but as something else (hence picked up when not specifying the sourcetype) and then once the events are being searched the sourcetype is changed to WinEventLog?

Might be worth a check to start with, but please let me know how you get on as happy to help further if I can!

syburcon
Engager

Hello. How do i determine what the original source name may be?

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...