Why search can return 200 result but stats count by host shows 0 result

[mind1n]

I used query index=testindex _raw=* and successfully returned 200+ result.

However, when I added stats index=testindex _raw=* | stats count by host, no result returned.

Is there anything missing when I use stats command?

Below is the splunk search result of the 1st query (without stats):

	21/02/11 21:23:45.000	2021_2_10-15_0_0_,1274423072.0 Major = 1274423072.0 Time = 2021_2_10-15_0_0_ host = splunktest index = testindex source = C:\git\splunktest\first.txt sourcetype = csv
	21/02/11 21:23:45.000	2021_2_10-14_59_0_,1274423072.0 Major = 1274423072.0 Time = 2021_2_10-14_59_0_ host = splunktest index = testindex source = C:\git\splunktest\first.txt sourcetype = csv
	21/02/11 21:23:45.000	2021_2_10-14_58_0_,1274423072.0 Major = 1274423072.0 Time = 2021_2_10-14_58_0_ host = splunktest index = testindex source = C:\git\splunktest\first.txt sourcetype = csv

[gcusello]

Hi @mind1n,

probably the problem is that you're running the search in Fast mode, so if you don't use stats, by default Splunk uses the Verbose Mode, instead, using stats, probably it uses the Fast Mode.

Try to use the Verbose Mode.

Then, try to cut _raw=* (that's unuseful) and your search (with stats) should run also in fast mode, because host is a field usable in Fast Mode.

Ciao.

Giuseppe

[isoutamo · Accepted solution]

And in this case it’s even better to use
|tstats count where index=testindex by host