Splunk Search

Why am I getting no results using Splunk JAVA SDK to run a search query with the stats command?

tmurray3
Path Finder

I am trying to use the JAVA Splunk SDK to run a query and return the results. I can get the events of the search returned if I use the search query:

String mySearch = "search index=auth \"Start:*.*\"";

However, when I try to use the stats commands with the above query, I get no results:

String mySearch = "search index=auth \"Start:*.*\" | stats count by TypeOfService";

I have tried various approaches, but unable to get the results.

Here is my latest code example:

public void search() {
    String mySearch = "search index=auth \"Start:*.*\" | stats count by TypeOfService";
    JobArgs jobArgs = new JobArgs();
    jobArgs.setEarliestTime("-1m");
    jobArgs.setLatestTime("now");
    Job job = service.getJobs().create(mySearch,jobArgs);

    // Wait for the job to finish
    while (!job.isDone()) {
        try {
            Thread.sleep(500);
        } catch (InterruptedException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
    }

    // Specify JSON as the output mode for results
    JobResultsArgs resultsArgs = new JobResultsArgs();
    resultsArgs.setOutputMode(JobResultsArgs.OutputMode.JSON);

    // Display results in JSON using ResultsReaderJson
    InputStream results = job.getResults(resultsArgs);
    ResultsReaderJson resultsReader=null;
    try {
        resultsReader = new ResultsReaderJson(results);
        HashMap<String, String> event;
        System.out.println("\nFormatted results from the search job as JSON\n");
        while ((event = resultsReader.getNextEvent()) != null) {
            for (String key: event.keySet())
                System.out.println("   " + key + ":  " + event.get(key));
        }
    } catch (IOException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } finally {

        try {
            resultsReader.close();
        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
    }
Tags (4)
0 Karma
1 Solution

tmurray3
Path Finder

The problem was related to the TypeOfService in the "stats count by TypeOfService" clause. The permissions on the field extraction TypeOfService was private and specific to an APP. I updated the permissions to Global (All apps), and was able to get the expected results.

View solution in original post

tmurray3
Path Finder

The problem was related to the TypeOfService in the "stats count by TypeOfService" clause. The permissions on the field extraction TypeOfService was private and specific to an APP. I updated the permissions to Global (All apps), and was able to get the expected results.

Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...