topic Re: Why does search in fast mode return different results than verbose mode in Splunk Enterprise 7.0.2? in Splunk Search

Why does search in fast mode return different results than verbose mode in Splunk Enterprise 7.0.2?

marycordova — Tue, 29 Sep 2020 20:48:11 GMT

Problem:

search: 1. Search: index=win* EventCode=4624 |userlookup(Account_Name)| table Account_Name name sam eid mail | rename Account_Name as user | search eid!=NONE_FOUND | dedup user name sam eid mail
static time range for explicit comparison: start 8/6/18 13:06:50.000; end 8/6/18 13:21:50.000
fast 13 results; verbose 1257 results
userlookup macro takes in a single attribute and attempts to match it against multiple columns in lookup table: eval $attribute$=lower($attribute$) | lookup ad_users.csv sam as $attribute$ OUTPUTNEW name eid sam upn created pwd_set mail tel_ext manager division job department region country | lookup ad_users.csv mail as $attribute$ OUTPUTNEW name eid sam upn created pwd_set mail tel_ext manager division job department region country | lookup ad_users.csv upn as $attribute$ OUTPUTNEW name eid sam upn created pwd_set mail tel_ext manager division job department region country | eval $attribute$=upper($attribute$) | lookup ad_users.csv eid as $attribute$ OUTPUTNEW name eid sam upn created pwd_set mail tel_ext manager division job department region country | eval $attribute$=lower($attribute$) | eval eid=upper(eid)

Re: Why does search in fast mode return different results than verbose mode in Splunk Enterprise 7.0.2?

marycordova — Mon, 06 Aug 2018 21:07:28 GMT

Splunk JIRA SPL-153269

A configuration added somewhere between Splunk Enterprise versions 6.4.? and 7.0.2 introduced an issue where using a macro with several lookups against the same lookup table results in only a single match attempt with subsequent matches against the lookup table being skipped.

Make the following configuration change to limits.conf:
[search_optimization::projection_elimination] cmds_black_list = lookup

There should not be a significant performance hit since this is just reverting this configuration to that in a previous version of Splunk.

Fix has been tested and confirmed in my environment, under these specific test conditions. I know the problem didn't exist under some version of 6.x and started in some version of 7.x, I just don't recall which upgrade specifically broke the macro/lookups. I am not sure if it resolves other similar behavior observed under different conditions.

Re: Why does search in fast mode return different results than verbose mode in Splunk Enterprise 7.0.2?

marycordova — Mon, 06 Aug 2018 21:09:48 GMT

Re: Why does search in fast mode return different results than verbose mode in Splunk Enterprise 7.0.2?

drfk — Thu, 27 Jun 2019 11:51:33 GMT

We have the same problem without using a macro in Splunk 6.6.5. The search of type
... | lookup table field1 OUTPUT newfield | lookup table field2 OUTPUTNEW newfield
is (in fast mode) "optimized" to
... | lookup table field2 OUTPUTNEW newfield

Just wanted to confirm that your limits.conf entry solves the problem. Thanks for that!

Re: Why does search in fast mode return different results than verbose mode in Splunk Enterprise 7.0.2?

m2oswald — Fri, 24 Sep 2021 07:58:06 GMT

Similar setup to drfk, with no macro but 2 lookups. Splunk 8.2.2. Verbose mode gave results, but Fast/Smart modes just resulted in 0's. Changing the limits.conf file fixed the problem. Thank you!

Re: Why does search in fast mode return different results than verbose mode in Splunk Enterprise 7.0.2?

Robertoing — Mon, 16 May 2022 12:30:03 GMT

Hi @marycordova ,

I have a distributed environment and I put this configuration in every SH at path /splunk/etc/system/local, but doesn't work.

Can someone help me to find out the correct solution?

Thank to all.

Re: Why does search in fast mode return different results than verbose mode in Splunk Enterprise 7.0.2?

marycordova — Mon, 16 May 2022 19:29:27 GMT

i know this is kind of a lame response but, @Robertoing , are you able to upgrade to version 8?

Re: Why does search in fast mode return different results than verbose mode in Splunk Enterprise 7.0.2?

rajan_kumar_rai — Mon, 12 Aug 2024 08:15:30 GMT

Facing the same issue in Splunk Enterprise version - 8.2.6.1

Any fix? workaround? please share !!