Splunk Search

Stats Results After Upgrade

dpwtheitguy
Loves-to-Learn Lots

All,

Just upgraded to 8.2.1 last night and noticed something today with stats.

# This search returns 160k+ events
index=netfw
162276

# This returns a 0 in Smart mode, this search returned data in 8.1.x how ever no data in 8.2.1
index=netfw | stats count
0

# Same search in Verbose mode however returns the count
index=netfw | stats count
162276

Shouldn't Smart mode have returned the count correctly also? It did work that way in 8.1

Labels (1)
0 Karma

vivekarora
Engager

Yes, It should return the same result in both smart and verbose mode.

I am also using Splunk 8.2.1

Attaching the screenshot for your reference.

I am using index=snow, its returing 99 events.

vivekarora_0-1627708660914.png

 

When I am using stats command, index=snow|stats count in verbose mode, its showing same 99 events

vivekarora_1-1627708751298.png

If I am using same stats command in smart mode, its showing same result

index=snow | stats count

 

vivekarora_2-1627708840996.png

 

Hence, the output of stats command in smart and verbose mode in splunk 8.2.1 is same.

 

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...