topic Re: Why do I have a different result in a saved search from CSV files and a different saved search history? in Getting Data In

Why do I have a different result in a saved search from CSV files and a different saved search history?

ifbeli — Fri, 09 Feb 2018 12:50:35 GMT

Hi guys,

We have a saved search that takes its sources from 5 csv files. On a run, it returns back 10k of events.

However, when I have a look at the saved search history, the number of events is not 10k and the source csv file for the current day is not there, meaning that we have 4 csv files as sources.

May be I am missing something, but is that a default behavior or something that we could change here ?

Let me know if you need more information.

Regards,

Iliya

Re: Why do I have a different result in a saved search from CSV files and a different saved search history?

micahkemp — Fri, 09 Feb 2018 17:14:34 GMT

How is your search taking data from the CSV files? Are they indexed files, or are you using | inputlookup or something else?

Re: Why do I have a different result in a saved search from CSV files and a different saved search history?

ifbeli — Mon, 12 Feb 2018 06:49:07 GMT

They are indexed files.

Re: Why do I have a different result in a saved search from CSV files and a different saved search history?

valiquet — Fri, 09 Mar 2018 11:24:02 GMT

Maybe you reached numb. of results in limits.conf
Maybe check if it's shared globally