https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455599#M78786 <P>Hello guys,</P> <P>Could you let me know the difference in terms of buckets between :</P> <P><CODE>| dbinspect *search* and *search* | eval bkt=_bkt | table bkt</CODE> ?<BR /> It looks like <CODE>dbinspect</CODE> returns more results and with a wider span. My aim is to remove buckets according to a specific search and timeframe.</P> <P>Thanks.</P> Thu, 13 Sep 2018 13:11:24 GMT splunkreal 2018-09-13T13:11:24Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455599#M78786 <P>Hello guys,</P> <P>Could you let me know the difference in terms of buckets between :</P> <P><CODE>| dbinspect *search* and *search* | eval bkt=_bkt | table bkt</CODE> ?<BR /> It looks like <CODE>dbinspect</CODE> returns more results and with a wider span. My aim is to remove buckets according to a specific search and timeframe.</P> <P>Thanks.</P> Thu, 13 Sep 2018 13:11:24 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455599#M78786 splunkreal 2018-09-13T13:11:24Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455600#M78787 <P>What are you trying to achieve by removing buckets?<BR /> You've also only posted a single search query mentioning dbinspect, dbinspect lists buckets on a per-index basis including replicated buckets.</P> Thu, 13 Sep 2018 23:13:07 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455600#M78787 gjanders 2018-09-13T23:13:07Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455601#M78788 <P>Solved by support :</P> <P>dbinspect take it data from the metadata <BR /> _bkt from from the search process. </P> <P>the metadata can be update when we search but you <BR /> will search on your old generation id. </P> Fri, 14 Sep 2018 07:26:54 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455601#M78788 splunkreal 2018-09-14T07:26:54Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455602#M78789 <P>Can you accept your answer please? That will make this clear that you've answered your own question</P> Fri, 14 Sep 2018 11:21:52 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455602#M78789 gjanders 2018-09-14T11:21:52Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455603#M78790 <P>"We're sorry, but you cannot vote on your own post." <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 14 Sep 2018 12:24:37 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455603#M78790 splunkreal 2018-09-14T12:24:37Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455604#M78791 <P>Correct, but as per <A href="https://docs.splunk.com/Documentation/Splunkbase/splunkbase/Answers/HowtoearnKarma">How to earn Karma</A> you will get some points and you can up-vote anyone else's posts <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Sat, 15 Sep 2018 00:42:18 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-difference-between-the-dbinspect-command-and-quot/m-p/455604#M78791 gjanders 2018-09-15T00:42:18Z