All,
Just upgraded to 8.2.1 last night and noticed something today with stats.
# This search returns 160k+ events
index=netfw
162276
# This returns a 0 in Smart mode, this search returned data in 8.1.x how ever no data in 8.2.1
index=netfw | stats count
0
# Same search in Verbose mode however returns the count
index=netfw | stats count
162276
Shouldn't Smart mode have returned the count correctly also? It did work that way in 8.1
Yes, It should return the same result in both smart and verbose mode.
I am also using Splunk 8.2.1
Attaching the screenshot for your reference.
I am using index=snow, its returing 99 events.
When I am using stats command, index=snow|stats count in verbose mode, its showing same 99 events
If I am using same stats command in smart mode, its showing same result
index=snow | stats count
Hence, the output of stats command in smart and verbose mode in splunk 8.2.1 is same.