Splunk Search
Highlighted

My search returns results when run in an app's search bar, but why are there no results when run in the Search & Reporting app?

New Member

Hi Guys,

I am not getting any result from the main search bar with the search below. Even though the same query is working in the App search bar.

index=protect "File Status"=unsafe user="*" "File Name"="*" | dedup "DeviceName", SHA256, "File Path", "File Name" | stats count by "Classification", "File Status", "DeviceName", "File Name" | addtotals fieldname=sum | sort -count | head 10

I checked with the below searches too.

index=main "File Status"=unsafe user="*" "File Name"="*" | dedup "DeviceName", SHA256, "File Path", "File Name" | stats count by "Classification", "File Status", "DeviceName", "File Name" | addtotals fieldname=sum | sort -count | head 10

and

index=*  "File Status"=unsafe user="*" "File Name"="*" | dedup "DeviceName", SHA256, "File Path", "File Name" | stats count by "Classification", "File Status", "DeviceName", "File Name" | addtotals fieldname=sum | sort -count | head 10

Can someone help me out on this or tell me why the result is not populating?

0 Karma
Highlighted

Re: My search returns results when run in an app's search bar, but why are there no results when run in the Search & Reporting app?

Motivator

Have you checked to see if the app permissions or the extracted fields are set to global?

0 Karma
Highlighted

Re: My search returns results when run in an app's search bar, but why are there no results when run in the Search & Reporting app?

New Member

Hi

I have checked that its not global. Its based on app only. How do I change to global as I have not got that option yet. Can you please guide me?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.