Splunk Search

deprecated 'stats' command syntax notification on a sample Splunk search

mitag
Contributor

Running a sample search suggested by "Add sparklines to search results" in Splunk Documentation for the latest version (8.0.5 as of this writing):

index=_internal | chart sparkline count by sourcetype

... results in the following "green" job notification:

This search uses deprecated 'stats' command syntax. This syntax implicitly translates '<function>' or '<function>()' to '<function>(*)', except for cases where the function is 'count'. Use '<function>(*)' instead.

Splunk info msg - Screen Shot 2020-08-11 at 8.48.55 AM.png

(This is reproduced in Splunk Enterprise versions 8.02, 8.04.1, 8.05.)

Questions:

  • Does this happen for you, too (in Splunk Enterprise versions 8.x)?
  • Why does Splunk use deprecated syntax in their docs? (Is there a good reason for it, or is this simply a benign case of a slightly stale documentation that's just not worth of an update?)
  • How would one modify the above search to (1) eliminate the "deprecated syntax" message while (2) retaining both the sparkline and the count fields, and optionally, (3) making it at least as performant as the "deprecated" one?

Thank you!

(This question is a more generic follow up to "This search uses deprecated 'stats' command syntax."  that was answered by @richgalloway (thank you).)

Labels (1)
Tags (2)
0 Karma
1 Solution

mattness
Splunk Employee
Splunk Employee

Turns out this particular example is a bug. Splunk 8.0.0 through 8.0.6 generates this "info message" when you use sparkline without an argument (such as sparkline(count) or sparkline(count(cpu)). This isn't supposed to happen. The bug is fixed in upcoming versions of Splunk. 

As for supporting deprecated syntax - well, sometimes we do that for backwards-compatibility, when people are upgrading from older versions of the product. 

View solution in original post

Tags (1)

mattness
Splunk Employee
Splunk Employee

Turns out this particular example is a bug. Splunk 8.0.0 through 8.0.6 generates this "info message" when you use sparkline without an argument (such as sparkline(count) or sparkline(count(cpu)). This isn't supposed to happen. The bug is fixed in upcoming versions of Splunk. 

As for supporting deprecated syntax - well, sometimes we do that for backwards-compatibility, when people are upgrading from older versions of the product. 

Tags (1)
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...