I have downloaded the cloudflare app in my splunk and had set the index as "cf_index". However, when i open the app , it says zero results. This is the search query of a field | tstats sum(cloudflare.bytes_out) as total_bandwidth from datamodel=cloudflare.cloudflare where cloudflare.ClientCountry="*" cloudflare.ClientDeviceType="*" cloudflare.dest_ip="*" cloudflare.dest_host="*" cloudflare.uri_path="*" cloudflare.http_user_agent="*" cloudflare.status="*" cloudflare.src_ip="*" cloudflare.OriginResponseStatus="*" cloudflare.RayID="*" cloudflare.WorkerSubrequest="*" cloudflare.http_method="*" | eval total_bandwidth=round(total_bandwidth/1000000,2) no results were found for this query I would like to know there were no results found ?. if i search for my index "cf_index" in search, it shows the data. how to verify if cloudflare is referring to my index or trying to get data from my index?
... View more
