About wrongquery

wrongquery · ‎11-09-2022

No luck my friend

wrongquery · ‎11-08-2022

Nothings changed from what I can see, the selected fields is just the top three. Host, source, and sourcetype. Maybe just try other queries for the time being and come back to it?

wrongquery · ‎11-08-2022

Yes data is still coming into splunk. I've tried last four, 24, and 7 days. If I just do index=* and sourcetype=* which I understand can be a lot of data I get information, but when i do my stats it won't show but my stats was working before. Does the query look like it should work?

wrongquery · ‎11-08-2022

So based off my original query that shows 100+ hosts, I would like to generate a list of the hosts in statistics but my query isn't populating. It's worked before but for some reason none of the queries that are similar to this one are working. Suggestions on refining my query? index=* sourcetype=* | stats count as host by "selected fields" | stats list(host) as host list(selected fields) as "selected fields"

Posts	4
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎11-08-2022

Online Status	Offline
Date Last Visited	‎11-09-2022 12:52 PM

How to refine search to pull the hosts that has 10...

Re: Trying to pull the hosts that has 100+ results...

Re: Trying to pull the hosts that has 100+ results...

Re: Trying to pull the hosts that has 100+ results...

How to refine search to pull the hosts that has 10...