Events Not Appearing in Statistics Tab

Quick Answer

Splunk's search results interface has separate tabs, Events, Statistics, and Visualization, and which ones show meaningful content depends entirely on whether the search includes a transforming command. Commands like stats, chart, and timechart don't just filter or annotate the existing events, they consume the raw event stream and replace it with a newly computed, aggregated table, which is exactly why the Statistics tab is populated with results while the Events tab appears empty: the individual raw events were used to build the aggregation but are no longer being passed through as separate result rows. This is different from non-transforming commands, which narrow, filter, or modify events while still leaving them as individual events, so the Events tab continues to show them in those cases. Once you recognize that stats-family commands are the reason for this behavior, the fix, if raw events are also needed, is to reference them differently, for example by running a separate non-transforming search or restructuring the query so the transforming command runs only where its output is actually needed. Whenever a question describes seeing a table of aggregated numbers in the Statistics tab but an unexpectedly empty Events tab, that combination is the signature of a transforming command in the search, and checking for stats, chart, or timechart in the SPL is the first thing to look for.