Why do transforming commands not work after upgrade to Splunk 8?

[sistemistiposta]

Hello,

   I have recently upgraded from Splunk 7 to Splunk 8.2.4.

After the upgrade, I noticed that some transform commands such as chart or stats do not work in smart and fast mode.

For instance:

index=main | chart count by host

returns the expected results in detailed mode. It returns 0 results in smart and fast mode.

Ps:

The transaction command still works, but I have to select the fields I want with fields in place of table. In Splunk 7 table works too.

I would like that stats and chart commands still work in fast search mode, as it happened in Splunk 7. Could you help me to revert the Splunk 7 working mode?

Thank you very much

Kind Regards

Marco

[landster]

Hello @sistemistiposta,

Yes, we completed that update immediately following the update to 8.2.5.  That is interesting...   It also seems the issue may exist beyond transforming commands as I have seen it on a simple table command.  I am also waiting eagerly on a response.

[sistemistiposta]

Aaaah yes, it seems the same issue.

Many days ago I opened a support ticket, as @isoutamo suggested.

We will see...

Kind Regards

Ciao

Marco

[gcusello]

Hi @landster,

this is adifferent situation because , with your solution, you don't consider in your results the duplicated events you have, my hont is to try to understand why you have duplicated events!

Anyway, it's better to put this question in a separated post so more people can help you to solve your problem.

Ciao.

Giuseppe