Getting Data In

Ingest Actions sample data missing for WinEventLog sourcetype

cdavidsonbp
Observer

Hello,

When I try to sample data for the WinEventLog sourcetype in Ingest Actions I get an error message:
     "No results found. Try expanding the time range."

Expanding the query I see Splunk using the following and manually running this query does not return any results either:
     

index=* OR index=_* sourcetype="WinEventLog"
     | where sourcetype="WinEventLog"
     | head 100

 

However, I do get results when I manually run either:
   

  index=* OR index=_*
     | where sourcetype="WinEventLog"
     | head 100

            OR

    

 index=* OR index=_* sourcetype="WinEventLog"
     | head 100

Can someone please explain why the first query may not be working? Is there a different way I should be working with the WinEventLog sourcetype in Ingest Actions? Thanks in advance for your help!

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It does seem like a bug in optimizer.

I did a search

index=winevents sourcetype=WinEventLog
| where sourcetype="WinEventLog"

It did not return any results - as was in your case.

But when I opened the job inspector it showed me the search optimized to

search (index="winevents" sourcetype=WinEventLog sourcetype=CASE("WinEventLog"))

 

0 Karma

livehybrid
Builder

Do you have any sourcetype renaming taking place or anything that might be changing the value of the sourcetype field?

I am wondering if the data is not indexed with sourcetype WinEventLog but as something else (hence picked up when not specifying the sourcetype) and then once the events are being searched the sourcetype is changed to WinEventLog?

Might be worth a check to start with, but please let me know how you get on as happy to help further if I can!

syburcon
Engager

Hello. How do i determine what the original source name may be?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...