Splunk Search

Why same search query shows two different results when executed via different apps? (No Macros used.)

iparitosh
Path Finder

Exact same query when run via search app returns 0 Statistics but shows correct stats when run via cloud monitoring app.
I am not using any macros here.

What could be the issue here?

Query [Time range: Yesterday]:

(search_id!="rsa_" action=search host= host=sh*.splunkcloud.com index=audit sourcetype=audittrail NOT user=cmon_user NOT user=internal_monitoring NOT user=ops_admin)
| eval user=if((user == "n/a"),null(),user), search_type=case(match(search_id,"^SummaryDirector
"),"summarization",match(savedsearch_name,"^ACCELERATE"),"acceleration",match(search_id,"^((rt_)?scheduler_|alertsmanager_)"),"scheduled",match(search_id,"\d{10}\.\d+(_[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})?$"),"ad hoc",true(),"other"), search=if((isnull(savedsearch_name) OR (savedsearch_name == "")),search,savedsearch_name)
| stats min(_time) as _time, values(user) as user, max(total_run_time) as total_run_time, first(search) as search, first(search_type) as search_type, first(apiStartTime) as apiStartTime, first(apiEndTime) as apiEndTime by search_id, host
| search (host=* search="" user="")
| where ((search_type = "scheduled") AND isnotnull(search))
| eval earliest=case((like(apiStartTime,"%ZERO_TIME%") AND like(apiEndTime,"%ZERO_TIME%")),"all time",like(apiStartTime,"%ZERO_TIME%"),"-",true(),apiStartTime), latest=case((like(apiStartTime,"%ZERO_TIME%") AND like(apiEndTime,"%ZERO_TIME%")),"all time",like(apiEndTime,"%ZERO_TIME%"),"-",true(),apiEndTime), _time=strftime('_time',"%m/%d/%Y %H:%M:%S %z")
| stats max(total_run_time) as total_run_time by search, _time, earliest, latest, search_type, user, host, search_id
| where (total_run_time >= 0)
| sort - total_run_time
| fields search, total_run_time, _time, earliest, latest, search_type, user
| eventstats count max(total_run_time) as max_run_time sum(total_run_time) as total_run_time_2 by search user
| sort 0 - total_run_time
| dedup search user
| fields search, max_run_time, _time, , earliest, latest, search_type, user, total_run_time_2 count
| rename _time as "Search Start", earliest as "Earliest Time", host as Host, latest as "Latest Time", search as "Report/Alert Name", search_id as SID, search_type as Type, max_run_time as "Max Runtime (seconds)", total_run_time_2 as "Total Runtime (seconds)", user as User, count as "Execution Count" | head

Screenshots:

alt text

alt text

0 Karma
1 Solution

broberg
Communicator

You may look on field extractions and lookups that excists only in one app and most likely not in the Search and report app, thats why you don't get any statistics.
For example: splunk do not know what "user" is if that field is field extracted in the other app but not in Search and reporting.

View solution in original post

broberg
Communicator

You may look on field extractions and lookups that excists only in one app and most likely not in the Search and report app, thats why you don't get any statistics.
For example: splunk do not know what "user" is if that field is field extracted in the other app but not in Search and reporting.

iparitosh
Path Finder

Thank you. Field extraction was not shared across all apps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...