Hi,
I have this SPL request in a search :
index=<my_index> (url_host="yqe-tractors.stenchkrzl.xyz" OR
url_host="stereotype.gumpzzyr.xyz" OR
url_host="tribes.mugsylhb.xyz" OR
url_host="taken-uprisings.coveringsiqnh.xyz" OR
url_host="unmarried.discussedya.xyp") | stats count by url_host
When I launch this request, in the job inspector I have a value for the scanCount.
When I modify my request by changing the extension "xyz" on any line of my request (by example with "org"), my scanCount value is None.
can Anyone explain me why the scanCount value is None when I modify the extension in one line of my request (example by replacing "xyz" by "org" in one line) ?
In my index I have more than 500 millions events for the last 30 days.
I am surprised, when I launch my request (same request as above) for the last 30 days, The search completed in 5 seconds whitout no results.
For me even if they are no results, as I have millions of events, Splunk will take more time to scan the millions of events and show the result. Am i wrong?
Thanks
