Splunk Search

With tstats command I can see the results in splunk, but with normal search I'm unable to see the results in Splunk?

babukumarreddy
Loves-to-Learn Lots

Hi 

For example 

Using below query i can see  when we received the last log to splunk, based on that if I search for events it's not showing 

Using below spl i can see when we we received latest events with below combination with 30 days timerange

 

|Tstats latest(_time) as _time where index=abc sourcetype="Cisco devises" host=1234 by index source sourcetype host. 

 

 

But if I search same spl for seeing events not showing the results --same timerange

index=abc sourcetype="Cisco devises" host=1234 

 

 

Labels (1)
0 Karma

jdunlea
Contributor

When you expand the time range for your regular (non-tstats) search, do you get any results? Like over a 24 hour or 7 day time range?

0 Karma

babukumarreddy
Loves-to-Learn Lots

@jdunlea with normal search i can't see any results after increasing the time range also.

 

0 Karma

jdunlea
Contributor

Were you ever seeing data in this index for any time range, using a normal search?

 

I am wondering if you are encountering an access problem for the specific index, and that the tstats search is returning something as a result of a bug. 

0 Karma

jdunlea
Contributor

Is the value for latest(_time) returning a time that is within your time range?

0 Karma

babukumarreddy
Loves-to-Learn Lots

@jdunlea Yes

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...