Splunk Search

deprecated 'stats' command syntax notification on a sample Splunk search

mitag
Contributor

Running a sample search suggested by "Add sparklines to search results" in Splunk Documentation for the latest version (8.0.5 as of this writing):

index=_internal | chart sparkline count by sourcetype

... results in the following "green" job notification:

This search uses deprecated 'stats' command syntax. This syntax implicitly translates '<function>' or '<function>()' to '<function>(*)', except for cases where the function is 'count'. Use '<function>(*)' instead.

Splunk info msg - Screen Shot 2020-08-11 at 8.48.55 AM.png

(This is reproduced in Splunk Enterprise versions 8.02, 8.04.1, 8.05.)

Questions:

  • Does this happen for you, too (in Splunk Enterprise versions 8.x)?
  • Why does Splunk use deprecated syntax in their docs? (Is there a good reason for it, or is this simply a benign case of a slightly stale documentation that's just not worth of an update?)
  • How would one modify the above search to (1) eliminate the "deprecated syntax" message while (2) retaining both the sparkline and the count fields, and optionally, (3) making it at least as performant as the "deprecated" one?

Thank you!

(This question is a more generic follow up to "This search uses deprecated 'stats' command syntax."  that was answered by @richgalloway (thank you).)

Labels (1)
Tags (2)
0 Karma
1 Solution

mattness
Splunk Employee
Splunk Employee

Turns out this particular example is a bug. Splunk 8.0.0 through 8.0.6 generates this "info message" when you use sparkline without an argument (such as sparkline(count) or sparkline(count(cpu)). This isn't supposed to happen. The bug is fixed in upcoming versions of Splunk. 

As for supporting deprecated syntax - well, sometimes we do that for backwards-compatibility, when people are upgrading from older versions of the product. 

View solution in original post

Tags (1)

mattness
Splunk Employee
Splunk Employee

Turns out this particular example is a bug. Splunk 8.0.0 through 8.0.6 generates this "info message" when you use sparkline without an argument (such as sparkline(count) or sparkline(count(cpu)). This isn't supposed to happen. The bug is fixed in upcoming versions of Splunk. 

As for supporting deprecated syntax - well, sometimes we do that for backwards-compatibility, when people are upgrading from older versions of the product. 

Tags (1)
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...