Installation

Why does the tstats with datamodel return 0 results after upgrade to Splunk 6.6.5 from Splunk 6.5.3?

clanier
Explorer

Hello!

Looking for some troubleshooting tips.

We have two separate Search Heads while we migrate our Applications from Splunk Search Head Version 6.5.3 to 6.6.5.

All of our various apps work flawlessly with the upgrade, however not one of our implementations, specifically App for Web Proxies. Which utilizes tstats on the Web Data Model.

Below are the Environments and the searches run with output on the Search Head. I have also included something I am a little interested in regarding further investigation within the Job Inspector and expanding the Search Job Properties.

Splunk 6.5.3

| datamodel Web search

Data Model search returns the expected number of events

| tstats prestats=false local=false summariesonly=false count from datamodel=Web 

Returns the expected number of events

{   [-] 
    :   {   [-] 
        type:   str 
    }   
    Web.action: {   [-] 
        type:   str 
    }   
    Web.is_Proxy:   {   [-] 
        type:   num 
    }   
    nodename:   {   [-] 
        type:   str 
    }   
}

fieldMetadataEvents in search job inspector
Splunk 6.6.5

| datamodel Web search

Data Model search returns expected number of events

| tstats prestats=false local=false summariesonly=false count from datamodel=Web 

Problem area above returns no events

{   [-] 
    :   {   [-] 
        type:   str 
    }   
}

fieldMetadataEvents in search job inspector does not reflect pulling fields of the Data Model

If anyone has encountered something like this, or has a good idea on the best way to troubleshoot, I am all ears. Both search heads are pointed to similar indexers, as well as both versions of the apps installed on the Search Head are the same.

Thanks for your help!

Labels (2)
0 Karma
1 Solution

clanier
Explorer

An upgrade to the indexer solved this issue. Thanks.

View solution in original post

0 Karma

clanier
Explorer

An upgrade to the indexer solved this issue. Thanks.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...