Splunk Search

Syntax that works in 6.1.1 (SPLUNK Enterprise) doesn't work in 6.4.2 (HUNK)

FrankBurns
New Member

This syntax ..

| stats sum(transmitted_MB) AS transmitted_total_MB, sum(received_MB) AS received_total_MB, count earliest(_time) AS et count latest(_time) AS lt BY username, src, url, http_method, http_user_agent, filter_category

works fine on our Live environment which is 6.1.1 SPLUNK enterprise.

We are upgrading and migrating to a 6.4.2 environment using HUNK to a HADOOP back end. The same syntax (literally cut and pasted over) throws the following error.

Error in 'stats' command: 1 duplicate rename field(s). Original renames: [transmitted_total_MB received_total_MB count et count lt]. Duplicate renames: [count].

Has anyone seen something similar?

Tags (1)
0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Can you validate if this works when you use Splunk 6.4.2 instead of Hunk 6.4.2?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...