topic Re: Inconsistent search result in Splunk Search

Inconsistent search result

PeterEccles — Wed, 23 Dec 2020 21:45:19 GMT

I have been using the range picker for a long time to run a search against data ingested the previous day. I normally use the Date Range picker and select the date between yesterday’s date 00:00 and yesterday’s date 24:00. This has worked fine for me. I was told that I can just use the "Yesterday" preset (or add earliest=-d@d latest=@d to the query). I know its obvious, but I missed it.

I get different results if I use the preset "Yesterday" against what I have been doing with the date picker. This is not a minor difference.

Can anyone think why this might be happening?

Thank you!

Re: Inconsistent search result

to4kawa — Wed, 23 Dec 2020 23:15:19 GMT

My sample query's result is following(Today is 12/24):

yesterday: 57,233 events (12/22/20 12:00:00.000 AM to 12/23/20 12:00:00.000 AM) 12/23 00:00:00~24:00:00:123,998 events (12/23/20 12:00:00.000 AM to 12/24/20 12:00:00.000 AM)

I think @d is not the intended date.

Re: Inconsistent search result

PeterEccles — Thu, 24 Dec 2020 09:03:08 GMT

-d@d is 100% coming back with the correct date (yesterday) it just not the same number of results as when I pick the date from the ranger picker.

Re: Inconsistent search result

PeterEccles — Thu, 24 Dec 2020 10:10:30 GMT

Please ignore this. I made a mistake 😞

Re: Inconsistent search result

annbrown — Thu, 24 Dec 2020 10:41:54 GMT

It's okay, it happens. Meanwhile, I would like to say that I'm a dissertation literature review writer.