Getting Data In

Ingest Actions sample data missing for WinEventLog sourcetype

cdavidsonbp
Observer

Hello,

When I try to sample data for the WinEventLog sourcetype in Ingest Actions I get an error message:
     "No results found. Try expanding the time range."

Expanding the query I see Splunk using the following and manually running this query does not return any results either:
     

index=* OR index=_* sourcetype="WinEventLog"
     | where sourcetype="WinEventLog"
     | head 100

 

However, I do get results when I manually run either:
   

  index=* OR index=_*
     | where sourcetype="WinEventLog"
     | head 100

            OR

    

 index=* OR index=_* sourcetype="WinEventLog"
     | head 100

Can someone please explain why the first query may not be working? Is there a different way I should be working with the WinEventLog sourcetype in Ingest Actions? Thanks in advance for your help!

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It does seem like a bug in optimizer.

I did a search

index=winevents sourcetype=WinEventLog
| where sourcetype="WinEventLog"

It did not return any results - as was in your case.

But when I opened the job inspector it showed me the search optimized to

search (index="winevents" sourcetype=WinEventLog sourcetype=CASE("WinEventLog"))

 

0 Karma

livehybrid
Super Champion

Do you have any sourcetype renaming taking place or anything that might be changing the value of the sourcetype field?

I am wondering if the data is not indexed with sourcetype WinEventLog but as something else (hence picked up when not specifying the sourcetype) and then once the events are being searched the sourcetype is changed to WinEventLog?

Might be worth a check to start with, but please let me know how you get on as happy to help further if I can!

syburcon
Engager

Hello. How do i determine what the original source name may be?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...