Splunk Search

Why doesn't my base search query work?

lsy9891
Engager

I wrote this base search query:

host=NETWEBA* sourcetype="WinEventLog:Application" AND ApplicationSource="/jpw*" AND "ErrorGUID" | fields OuterExceptionType

And I extended this query to get the top 5 exceptions

stats count by OuterExceptionType  AS "Outer_Exception_Type"| sort - "Outer_Exception_Type"

But it returns no results whereas if I don't use a base search it works fine?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@lsy9891

Not sure about field name changing but can you please try this?

stats count by OuterExceptionType  | sort - OuterExceptionType  

OR

stats count by OuterExceptionType  | sort - OuterExceptionType  | rename OuterExceptionType as  "Outer_Exception_Type"
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...