Splunk Search

My splunk stats count is showing count but unable to view the events

poddraj
Explorer

Hi,
When I search for a particular index in my splunk I am not getting any events data. However, when I do search the same index with stats by count I am getting count ass 1430. In both the cases my time range is All-time

index=check30|stats count --> This is giving me output as 1430
index=check30 --> This is not returning any events in search output

I re-started my splunk, cleared the cache and tried multiple browsers but still am unable to get the events in search head o/p. Please suggest what is wrong here as I am fed-up debugging this since morning.

0 Karma

oscar84x
Contributor

Off the top of my head, would you happen to maybe be searching in Fast mode instead of Smart or Verbose?

0 Karma

poddraj
Explorer

I am running the search in smart mode itself

0 Karma

to4kawa
Ultra Champion
    | tstats count where index=check30

This result is1430?
check job_inspector and search.log

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...