Hi,
I want to show the number of all my downloads with a Splunk search, but the search shows never all downloads how i want it.
Here is my search:
index=abc sourcetype=xyz country="USA" | top limit=2000 filetype| rename count AS "number of downloads"
For exampel, this search doesn't show the filetype pdf.
But the search:
index abc sourcetype = xyz country="USA" filetype=pdf |top limit=2000 filetype| rename count AS "number of downloads"
show that there are a big number of pdf's
and when i change the search to
index abc sourcetype = xyz country="USA" filetype=pdf OR fieltype=txt |top limit=2000 filetype| rename count AS "number of downloads"
There are NO results displayed
With the search
index abc sourcetype = xyz country="USA" |top limit=2000 filetype|search filetype=pdf fieltype=txt |rename count AS "number of downloads there are no results displayed too.
Did anybody of you know a answer, what ist my fault? I want to show all filetypes, but it is important that the pdf's dont will be ignored.
Thank you very much for your help, and sorry if this is to incomprehensible.
