Why does the tstats with datamodel return 0 results after upgrade to Splunk 6.6.5 from Splunk 6.5.3?

[clanier]

Hello!

Looking for some troubleshooting tips.

We have two separate Search Heads while we migrate our Applications from Splunk Search Head Version 6.5.3 to 6.6.5.

All of our various apps work flawlessly with the upgrade, however not one of our implementations, specifically App for Web Proxies. Which utilizes tstats on the Web Data Model.

Below are the Environments and the searches run with output on the Search Head. I have also included something I am a little interested in regarding further investigation within the Job Inspector and expanding the Search Job Properties.

Splunk 6.5.3

| datamodel Web search

Data Model search returns the expected number of events

| tstats prestats=false local=false summariesonly=false count from datamodel=Web 

Returns the expected number of events

{   [-] 
    :   {   [-] 
        type:   str 
    }   
    Web.action: {   [-] 
        type:   str 
    }   
    Web.is_Proxy:   {   [-] 
        type:   num 
    }   
    nodename:   {   [-] 
        type:   str 
    }   
}

fieldMetadataEvents in search job inspector
Splunk 6.6.5

| datamodel Web search

Data Model search returns expected number of events

| tstats prestats=false local=false summariesonly=false count from datamodel=Web 

Problem area above returns no events

{   [-] 
    :   {   [-] 
        type:   str 
    }   
}

fieldMetadataEvents in search job inspector does not reflect pulling fields of the Data Model

If anyone has encountered something like this, or has a good idea on the best way to troubleshoot, I am all ears. Both search heads are pointed to similar indexers, as well as both versions of the apps installed on the Search Head are the same.

Thanks for your help!

[clanier · Accepted solution]

An upgrade to the indexer solved this issue. Thanks.