Training + Certification Discussions

SplunkFundamentals Module 5

tylertyler
Explorer

Hello,

I've been following the free course for Splunk Fundamentals 1 and now I'm on lab 5. I have completed everything successfully up to this point. It is on basic searching and asks me to search "fail* AND password" over All-time. This is where my issue comes into play.

When I search over all-time I get 0 results. If I search last week 9,493. If I search last month 49.946.

I have verified that I have the correct number of indexed events. My hosts are correct. Why do I get 0 results under all-time? I have also tested under both admin and power accounts and get the same results.

0 Karma
1 Solution

tylertyler
Explorer

There are two options, One is All Time and Two is All Time(real-time). The first option is the one you want for labs and is in the presets menu but is cut off, so it displays "Al..." no wonder it was missed.

View solution in original post

0 Karma

tylertyler
Explorer

There are two options, One is All Time and Two is All Time(real-time). The first option is the one you want for labs and is in the presets menu but is cut off, so it displays "Al..." no wonder it was missed.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...