Splunk Search

Why doesn't my base search query work?

lsy9891
Engager

I wrote this base search query:

host=NETWEBA* sourcetype="WinEventLog:Application" AND ApplicationSource="/jpw*" AND "ErrorGUID" | fields OuterExceptionType

And I extended this query to get the top 5 exceptions

stats count by OuterExceptionType  AS "Outer_Exception_Type"| sort - "Outer_Exception_Type"

But it returns no results whereas if I don't use a base search it works fine?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@lsy9891

Not sure about field name changing but can you please try this?

stats count by OuterExceptionType  | sort - OuterExceptionType  

OR

stats count by OuterExceptionType  | sort - OuterExceptionType  | rename OuterExceptionType as  "Outer_Exception_Type"
0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...