topic Re: summary index vs search query in Knowledge Management

summary index vs search query

srinathd — Fri, 18 Oct 2013 11:59:55 GMT

Hi,

why sometimes there is a difference between summary index results and normal search query restuls for the same day? why it happens? and how to avoid this?

Re: summary index vs search query

_d_ — Fri, 18 Oct 2013 12:10:46 GMT

Provided that the searches that you run on raw index and summary index are equivalent, the results should be the same. Unless there are gaps or duplicates in your summary index.
If you could give more details around the background of the question; summary populating search, actual search query, difference in results, example etc. we should be able to help you better.

Re: summary index vs search query

somesoni2 — Fri, 18 Oct 2013 16:42:20 GMT

I am not sure if this is applicable in your situation, but I have faced similar issues of count of actual events not matching with event count in summary index due to a bug in Splunk version 5.0.3 or earlier. Please refer to this question. This bug was fixed in 5.0.5 and higher version. Worth looking.

http://answers.splunk.com/answers/94725/issue-with-summary-indexing-saved-searches-runs-fine-but-summary-index-data-is-not-written-sometimes

Re: summary index vs search query

srinathd — Mon, 21 Oct 2013 09:55:48 GMT

Is this issue resolved in version 5.0.4?