Training + Certification Discussions

SplunkFundamentals Module 5

tylertyler
Explorer

Hello,

I've been following the free course for Splunk Fundamentals 1 and now I'm on lab 5. I have completed everything successfully up to this point. It is on basic searching and asks me to search "fail* AND password" over All-time. This is where my issue comes into play.

When I search over all-time I get 0 results. If I search last week 9,493. If I search last month 49.946.

I have verified that I have the correct number of indexed events. My hosts are correct. Why do I get 0 results under all-time? I have also tested under both admin and power accounts and get the same results.

0 Karma
1 Solution

tylertyler
Explorer

There are two options, One is All Time and Two is All Time(real-time). The first option is the one you want for labs and is in the presets menu but is cut off, so it displays "Al..." no wonder it was missed.

View solution in original post

0 Karma

tylertyler
Explorer

There are two options, One is All Time and Two is All Time(real-time). The first option is the one you want for labs and is in the presets menu but is cut off, so it displays "Al..." no wonder it was missed.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...