Hi, New to Splunk so I must be missing something obvious. I looked through previous questions and the docs but didn't see anything about this problem. I have a Splunk query which is correctly returning the statistic I am expecting but has Events(0) even when Verbose Mode is enabled. index=* // search redacted
|rex "(?P<json>{.+})"
|table json
|spath input=json
|stats sum(Response.Selected) When I execute this query from Splunk Search (Web UI) I am getting the correct sum under the "Statistics" tab but the "Events" tab is (0). Any help would be much appreciated.
... View more