Splunk Search

deprecated 'stats' command syntax notification on a sample Splunk search

mitag
Contributor

Running a sample search suggested by "Add sparklines to search results" in Splunk Documentation for the latest version (8.0.5 as of this writing):

index=_internal | chart sparkline count by sourcetype

... results in the following "green" job notification:

This search uses deprecated 'stats' command syntax. This syntax implicitly translates '<function>' or '<function>()' to '<function>(*)', except for cases where the function is 'count'. Use '<function>(*)' instead.

Splunk info msg - Screen Shot 2020-08-11 at 8.48.55 AM.png

(This is reproduced in Splunk Enterprise versions 8.02, 8.04.1, 8.05.)

Questions:

  • Does this happen for you, too (in Splunk Enterprise versions 8.x)?
  • Why does Splunk use deprecated syntax in their docs? (Is there a good reason for it, or is this simply a benign case of a slightly stale documentation that's just not worth of an update?)
  • How would one modify the above search to (1) eliminate the "deprecated syntax" message while (2) retaining both the sparkline and the count fields, and optionally, (3) making it at least as performant as the "deprecated" one?

Thank you!

(This question is a more generic follow up to "This search uses deprecated 'stats' command syntax."  that was answered by @richgalloway (thank you).)

Labels (1)
Tags (2)
0 Karma
1 Solution

mattness
Splunk Employee
Splunk Employee

Turns out this particular example is a bug. Splunk 8.0.0 through 8.0.6 generates this "info message" when you use sparkline without an argument (such as sparkline(count) or sparkline(count(cpu)). This isn't supposed to happen. The bug is fixed in upcoming versions of Splunk. 

As for supporting deprecated syntax - well, sometimes we do that for backwards-compatibility, when people are upgrading from older versions of the product. 

View solution in original post

Tags (1)

mattness
Splunk Employee
Splunk Employee

Turns out this particular example is a bug. Splunk 8.0.0 through 8.0.6 generates this "info message" when you use sparkline without an argument (such as sparkline(count) or sparkline(count(cpu)). This isn't supposed to happen. The bug is fixed in upcoming versions of Splunk. 

As for supporting deprecated syntax - well, sometimes we do that for backwards-compatibility, when people are upgrading from older versions of the product. 

Tags (1)
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...