Splunk Search

My splunk stats count is showing count but unable to view the events

poddraj
Explorer

Hi,
When I search for a particular index in my splunk I am not getting any events data. However, when I do search the same index with stats by count I am getting count ass 1430. In both the cases my time range is All-time

index=check30|stats count --> This is giving me output as 1430
index=check30 --> This is not returning any events in search output

I re-started my splunk, cleared the cache and tried multiple browsers but still am unable to get the events in search head o/p. Please suggest what is wrong here as I am fed-up debugging this since morning.

0 Karma

oscar84x
Contributor

Off the top of my head, would you happen to maybe be searching in Fast mode instead of Smart or Verbose?

0 Karma

poddraj
Explorer

I am running the search in smart mode itself

0 Karma

to4kawa
Ultra Champion
    | tstats count where index=check30

This result is1430?
check job_inspector and search.log

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...