Splunk Search

incomprehensible value of Scancount

Naaba
New Member

Hi,

I have this SPL request in a search :

index=<my_index> (url_host="yqe-tractors.stenchkrzl.xyz" OR
url_host="stereotype.gumpzzyr.xyz" OR
url_host="tribes.mugsylhb.xyz" OR
url_host="taken-uprisings.coveringsiqnh.xyz" OR
url_host="unmarried.discussedya.xyp") | stats count by url_host

When I launch this request, in the job inspector I have a value for the scanCount.

When I modify my request by changing the extension "xyz" on any line of my request (by example with "org"), my scanCount value is None.

can Anyone explain me why the scanCount value is None when I modify the extension in one line of my request (example by replacing "xyz" by "org" in one line) ?

In my index I have more than 500 millions events for the last 30 days.
I am surprised, when I launch my request (same request as above) for the last 30 days, The search completed in 5 seconds whitout no results.
For me even if they are no results, as I have millions of events, Splunk will take more time to scan the millions of events and show the result. Am i wrong?

Thanks

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...