Splunk Search

My splunk stats count is showing count but unable to view the events

poddraj
Explorer

Hi,
When I search for a particular index in my splunk I am not getting any events data. However, when I do search the same index with stats by count I am getting count ass 1430. In both the cases my time range is All-time

index=check30|stats count --> This is giving me output as 1430
index=check30 --> This is not returning any events in search output

I re-started my splunk, cleared the cache and tried multiple browsers but still am unable to get the events in search head o/p. Please suggest what is wrong here as I am fed-up debugging this since morning.

0 Karma

oscar84x
Contributor

Off the top of my head, would you happen to maybe be searching in Fast mode instead of Smart or Verbose?

0 Karma

poddraj
Explorer

I am running the search in smart mode itself

0 Karma

to4kawa
Ultra Champion
    | tstats count where index=check30

This result is1430?
check job_inspector and search.log

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...