Splunk Search

Why same search query shows two different results when executed via different apps? (No Macros used.)

iparitosh
Path Finder

Exact same query when run via search app returns 0 Statistics but shows correct stats when run via cloud monitoring app.
I am not using any macros here.

What could be the issue here?

Query [Time range: Yesterday]:

(search_id!="rsa_" action=search host= host=sh*.splunkcloud.com index=audit sourcetype=audittrail NOT user=cmon_user NOT user=internal_monitoring NOT user=ops_admin)
| eval user=if((user == "n/a"),null(),user), search_type=case(match(search_id,"^SummaryDirector
"),"summarization",match(savedsearch_name,"^ACCELERATE"),"acceleration",match(search_id,"^((rt_)?scheduler_|alertsmanager_)"),"scheduled",match(search_id,"\d{10}\.\d+(_[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})?$"),"ad hoc",true(),"other"), search=if((isnull(savedsearch_name) OR (savedsearch_name == "")),search,savedsearch_name)
| stats min(_time) as _time, values(user) as user, max(total_run_time) as total_run_time, first(search) as search, first(search_type) as search_type, first(apiStartTime) as apiStartTime, first(apiEndTime) as apiEndTime by search_id, host
| search (host=* search="" user="")
| where ((search_type = "scheduled") AND isnotnull(search))
| eval earliest=case((like(apiStartTime,"%ZERO_TIME%") AND like(apiEndTime,"%ZERO_TIME%")),"all time",like(apiStartTime,"%ZERO_TIME%"),"-",true(),apiStartTime), latest=case((like(apiStartTime,"%ZERO_TIME%") AND like(apiEndTime,"%ZERO_TIME%")),"all time",like(apiEndTime,"%ZERO_TIME%"),"-",true(),apiEndTime), _time=strftime('_time',"%m/%d/%Y %H:%M:%S %z")
| stats max(total_run_time) as total_run_time by search, _time, earliest, latest, search_type, user, host, search_id
| where (total_run_time >= 0)
| sort - total_run_time
| fields search, total_run_time, _time, earliest, latest, search_type, user
| eventstats count max(total_run_time) as max_run_time sum(total_run_time) as total_run_time_2 by search user
| sort 0 - total_run_time
| dedup search user
| fields search, max_run_time, _time, , earliest, latest, search_type, user, total_run_time_2 count
| rename _time as "Search Start", earliest as "Earliest Time", host as Host, latest as "Latest Time", search as "Report/Alert Name", search_id as SID, search_type as Type, max_run_time as "Max Runtime (seconds)", total_run_time_2 as "Total Runtime (seconds)", user as User, count as "Execution Count" | head

Screenshots:

alt text

alt text

0 Karma
1 Solution

broberg
Communicator

You may look on field extractions and lookups that excists only in one app and most likely not in the Search and report app, thats why you don't get any statistics.
For example: splunk do not know what "user" is if that field is field extracted in the other app but not in Search and reporting.

View solution in original post

broberg
Communicator

You may look on field extractions and lookups that excists only in one app and most likely not in the Search and report app, thats why you don't get any statistics.
For example: splunk do not know what "user" is if that field is field extracted in the other app but not in Search and reporting.

iparitosh
Path Finder

Thank you. Field extraction was not shared across all apps.

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...