https://community.splunk.com/t5/Getting-Data-In/Metadata-and-tstats-give-different-sources-How-do-I-get-the-list/m-p/589095#M103340 <P>Make sure you are running both searches in the same time range.</P><P>Otherwise, I don't see any reason for them to show different results.</P><P>&nbsp;</P><P><SPAN>how can I search for all the increments of the source if I know what it is?</SPAN></P><P><SPAN>* You can use the search with metadata command.</SPAN></P><P><SPAN>* But you generally don't need it because Splunk will always monitor&nbsp;tortor-adaptor.log file not the rolled over filed (tortor-adaptor.log.1,&nbsp;tortor-adaptor.log.2, etc)</SPAN></P><P><SPAN>* So when you start logging for the first time only at that time it will monitor rolled-over files.</SPAN></P> Tue, 15 Mar 2022 13:34:34 GMT VatsalJagani 2022-03-15T13:34:34Z https://community.splunk.com/t5/Getting-Data-In/Metadata-and-tstats-give-different-sources-How-do-I-get-the-list/m-p/588913#M103319 <P>I have two search queries:</P> <PRE>| metadata index=* type=sources</PRE> <P>that results in something like the following (under the <EM>source</EM> field)</P> <PRE>/lorem/ipsum/dolor/sit/tortor-adaptor.log<BR />/lorem/ipsum/dolor/sit/tortor-adaptor.log.1<BR />/lorem/ipsum/dolor/sit/tortor-adaptor.log.10<BR />/lorem/ipsum/dolor/sit/tortor-adaptor.log.11<BR />/lorem/ipsum/dolor/sit/tortor-adaptor.log.12<BR />/lorem/ipsum/dolor/sit/tortor-adaptor.log.13<BR />/lorem/ipsum/dolor/sit/tortor-adaptor.log.14<BR />/lorem/ipsum/dolor/sit/tortor-adaptor.log.15<BR /><BR /></PRE> <P>&nbsp;then there's the following search</P> <PRE>| tstats values(source) where index=*</PRE> <P>that produces something like the following (under the <EM>values(source)</EM> field)</P> <PRE>/lorem/ipsum/dolor/sit/tortor-adaptor.log<BR />/lorem/ipsum/nunc-test.log.1<BR />/lorem/ipsum/dolor/sit/pulvinar/ex-eros.log<BR />/comsed/ipsum/dolor/ut-eget.log<BR />/donec/sit/nam-libero.log.1<BR />/aliquet/ipsum/dolor/sit/vel-arcu.log</PRE> <P>&nbsp;</P> <P>Why is Splunk showing me different results?</P> <P>Also, how can I search for all the increments of the source if I know what it is? For example, if I have "/lorem/ipsum/dolor/sit/tortor-adaptor.log" how can I find all of its increments (e.g. "/lorem/ipsum/dolor/sit/tortor-adaptor.log.1,&nbsp;/lorem/ipsum/dolor/sit/tortor-adaptor.log.2,&nbsp;/lorem/ipsum/dolor/sit/tortor-adaptor.log.3")?</P> Mon, 14 Mar 2022 19:28:30 GMT https://community.splunk.com/t5/Getting-Data-In/Metadata-and-tstats-give-different-sources-How-do-I-get-the-list/m-p/588913#M103319 yaharga 2022-03-14T19:28:30Z https://community.splunk.com/t5/Getting-Data-In/Metadata-and-tstats-give-different-sources-How-do-I-get-the-list/m-p/589095#M103340 <P>Make sure you are running both searches in the same time range.</P><P>Otherwise, I don't see any reason for them to show different results.</P><P>&nbsp;</P><P><SPAN>how can I search for all the increments of the source if I know what it is?</SPAN></P><P><SPAN>* You can use the search with metadata command.</SPAN></P><P><SPAN>* But you generally don't need it because Splunk will always monitor&nbsp;tortor-adaptor.log file not the rolled over filed (tortor-adaptor.log.1,&nbsp;tortor-adaptor.log.2, etc)</SPAN></P><P><SPAN>* So when you start logging for the first time only at that time it will monitor rolled-over files.</SPAN></P> Tue, 15 Mar 2022 13:34:34 GMT https://community.splunk.com/t5/Getting-Data-In/Metadata-and-tstats-give-different-sources-How-do-I-get-the-list/m-p/589095#M103340 VatsalJagani 2022-03-15T13:34:34Z