Training + Certification

SplunkFundamentals Module 5

tylertyler
Explorer

Hello,

I've been following the free course for Splunk Fundamentals 1 and now I'm on lab 5. I have completed everything successfully up to this point. It is on basic searching and asks me to search "fail* AND password" over All-time. This is where my issue comes into play.

When I search over all-time I get 0 results. If I search last week 9,493. If I search last month 49.946.

I have verified that I have the correct number of indexed events. My hosts are correct. Why do I get 0 results under all-time? I have also tested under both admin and power accounts and get the same results.

0 Karma
1 Solution

tylertyler
Explorer

There are two options, One is All Time and Two is All Time(real-time). The first option is the one you want for labs and is in the presets menu but is cut off, so it displays "Al..." no wonder it was missed.

View solution in original post

0 Karma

tylertyler
Explorer

There are two options, One is All Time and Two is All Time(real-time). The first option is the one you want for labs and is in the presets menu but is cut off, so it displays "Al..." no wonder it was missed.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!