Splunk Search

CLI search query not giving results. Working fine on searchhead GUI

Reethika
Path Finder

Hi,

/opt/splunk/bin/splunk search " index=****  sourcetype="*****:proxylogs" earliest=-15m@m latest=now | fields action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time | table action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time ')"

Result : INFO: No matching fields exist.
                INFO: Your timerange was substituted based on your search string

Above is the search for which no results are returned from CLI. 

From GUI(Searchhead) I get results. 

 

Could anyone please help. 

Thanks

Labels (1)
Tags (2)
0 Karma

niketnilay
Legend

Can you try the following:

 

./splunk search 'index=****  sourcetype="*****:proxylogs" earliest=-15m@m latest=now | fields index,sourcetype,action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time | table index,sourcetype,action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time'

 Also do you not get any result even if you increase the time window for the search?

I tried the following and it worked fine. (I had some data with csv sourcetype and did not have all the fields).

 ./splunk search 'index=****  sourcetype="*****_csv" earliest=-1mon latest=now | fields index,sourcetype,action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time | table index,sourcetype,action,bytes,bytes_in,bytes_out,src,category,date_hour,date_mday,date_minute,date_month,date_second,date_wday,date_year,date_zone,url,site,domain,dest_ip,user,user_bunit,user_work_city,user_work_country,user_work_lat,user_work_long,_time'

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!