Splunk Dev

Why can't I see the group tcpin_connections?


I am trying to leverage the information on the metrics.log file.
I am using this: index=_internal source=metrics.log group=tcpin_connections
This was working before and for some reason unknown it is not any more (nobody knows what happened).
I created a | table groups
so I could see all the groups in the file and I could not see tcpin*.
I go to the log file and I actually see tcpin*
Any ideas on what's going on?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...