Ingest Actions sample data missing for WinEventLog sourcetype

[cdavidsonbp]

Hello,

When I try to sample data for the WinEventLog sourcetype in Ingest Actions I get an error message:
     "No results found. Try expanding the time range."

Expanding the query I see Splunk using the following and manually running this query does not return any results either:
     

index=* OR index=_* sourcetype="WinEventLog"
     | where sourcetype="WinEventLog"
     | head 100

However, I do get results when I manually run either:
   

  index=* OR index=_*
     | where sourcetype="WinEventLog"
     | head 100

            OR

 index=* OR index=_* sourcetype="WinEventLog"
     | head 100

Can someone please explain why the first query may not be working? Is there a different way I should be working with the WinEventLog sourcetype in Ingest Actions? Thanks in advance for your help!

[PickleRick]

It does seem like a bug in optimizer.

I did a search

index=winevents sourcetype=WinEventLog
| where sourcetype="WinEventLog"

It did not return any results - as was in your case.

But when I opened the job inspector it showed me the search optimized to

search (index="winevents" sourcetype=WinEventLog sourcetype=CASE("WinEventLog"))

[livehybrid]

Do you have any sourcetype renaming taking place or anything that might be changing the value of the sourcetype field?

I am wondering if the data is not indexed with sourcetype WinEventLog but as something else (hence picked up when not specifying the sourcetype) and then once the events are being searched the sourcetype is changed to WinEventLog?

Might be worth a check to start with, but please let me know how you get on as happy to help further if I can!

[syburcon]

Hello. How do i determine what the original source name may be?