Getting Data In

Spath queries return no results. How to troubleshoot?

bbegyperkspot
Explorer

I have a Json formatted log. Splunk shows my fields just fine. If I click one of my fields to filter by that field, Splunk copies my values into the search box. Suddenly today, this search returns zero results.

How do I start debugging this?

Tags (2)
0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Use the Job Inspector

If your search returns an error you'll see this
alt text

If you don't get an error, you can get to the job inspector from the Job menu dropdown:
alt text

Then scroll down to messages and you'll find information on debugging.

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...