https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461206#M130093 <P>I'm using base search in my dashboard, <BR /> In dashboard panels , one created using base search query and other one is using normal query.<BR /> but base search one is giving three events less than the normal query( Which is correct and accurate).<BR /> So i doubted that base search will ignore event's if it will take more time to run query.</P> <P>(here i'm trying to count the events based on specific fields)</P> <P>If any one knows please clarify.</P> <P>And one more thing , but sometimes base search is also giving accurate results(but it's very rare, one time only i saw).</P> Mon, 30 Mar 2020 12:59:06 GMT kirrusk 2020-03-30T12:59:06Z https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461206#M130093 <P>I'm using base search in my dashboard, <BR /> In dashboard panels , one created using base search query and other one is using normal query.<BR /> but base search one is giving three events less than the normal query( Which is correct and accurate).<BR /> So i doubted that base search will ignore event's if it will take more time to run query.</P> <P>(here i'm trying to count the events based on specific fields)</P> <P>If any one knows please clarify.</P> <P>And one more thing , but sometimes base search is also giving accurate results(but it's very rare, one time only i saw).</P> Mon, 30 Mar 2020 12:59:06 GMT https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461206#M130093 kirrusk 2020-03-30T12:59:06Z https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461207#M130094 <P>Please share your base search.</P> Mon, 30 Mar 2020 13:12:16 GMT https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461207#M130094 richgalloway 2020-03-30T13:12:16Z https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461208#M130095 <P>@kirrusk Yes it is expected that Post Processing Base search may drop events silently if there are events greater than that configured in limits.conf. By default 500K events.</P> <P>So there are certain best practices around use of Base Search for post-processing. Please refer to Splunk documentation to know about both of these: <A href="https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Use_a_transforming_base_search">https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Use_a_transforming_base_search</A></P> <P>[UPDATED] default limit is 500K not 50K. Thanks for the correction @nplamondon <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 31 Mar 2020 10:21:03 GMT https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461208#M130095 niketn 2020-03-31T10:21:03Z https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461209#M130096 <P>We need your entire dashboard.</P> Tue, 31 Mar 2020 13:24:01 GMT https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461209#M130096 woodcock 2020-03-31T13:24:01Z https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461210#M130097 <P>A <CODE>base search</CODE> is <EM>NOT</EM> a <CODE>subsearch</CODE> and is not under those limits.</P> Tue, 31 Mar 2020 13:26:10 GMT https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461210#M130097 woodcock 2020-03-31T13:26:10Z https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461211#M130098 <P>@niketnilay is off by 10x, but otherwise correct.</P> <BLOCKQUOTE> <P>If the base search is a non-transforming search, the Splunk platform retains only the first 500,000 events that it returns.</P> </BLOCKQUOTE> Mon, 13 Apr 2020 17:40:59 GMT https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461211#M130098 nplamondon 2020-04-13T17:40:59Z https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461212#M130099 <P>Thanks for pointing it out @nplamondon . I have corrected the default limit <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 14 Apr 2020 07:43:52 GMT https://community.splunk.com/t5/Splunk-Search/Is-base-search-will-ignore-events/m-p/461212#M130099 niketn 2020-04-14T07:43:52Z