Splunk Search

My splunk stats count is showing count but unable to view the events

poddraj
Explorer

Hi,
When I search for a particular index in my splunk I am not getting any events data. However, when I do search the same index with stats by count I am getting count ass 1430. In both the cases my time range is All-time

index=check30|stats count --> This is giving me output as 1430
index=check30 --> This is not returning any events in search output

I re-started my splunk, cleared the cache and tried multiple browsers but still am unable to get the events in search head o/p. Please suggest what is wrong here as I am fed-up debugging this since morning.

0 Karma

oscar84x
Contributor

Off the top of my head, would you happen to maybe be searching in Fast mode instead of Smart or Verbose?

0 Karma

poddraj
Explorer

I am running the search in smart mode itself

0 Karma

to4kawa
Ultra Champion
    | tstats count where index=check30

This result is1430?
check job_inspector and search.log

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...