https://community.splunk.com/t5/Splunk-Search/Result-differences/m-p/254676#M176465 <P>I understand that </P> <P>WinTempFieldType=* | search WinTempFieldType=Error </P> <P>is a search within a search and would take longer...and I'm really not concerned with time, the number of results found is the most important, by is there such (any) difference.</P> Fri, 14 Oct 2016 17:36:11 GMT tinylund 2016-10-14T17:36:11Z https://community.splunk.com/t5/Splunk-Search/Result-differences/m-p/254675#M176464 <P>Fairly new to Splunk and I am trying to understand the reason for the difference in results and search time for the following:</P> <P>Created an extracted field for a Windows log - WinTempFieldType</P> <P>When I run a search for: WinTempFieldType=Error <BR /> Search takes seconds, less that a full minute and finds less than 100 results</P> <P>When I run a search for: WinTempFieldType=* | search WinTempFieldType=Error <BR /> Search takes 15 minutes and finds 5,000+ results</P> <P>I ran across this, because I have a report that has a table that I based off the following search: WinTempFieldType=* | stats count WinTempFieldType | sort -count | table WinTempFieldType count </P> <P>When the report ran the table showed the WinTempFieldType row with Error and a count over 5,000 - but when I clicked on the error cell to drill down, the pending search only showed less than 100 results. So that is when I tried to manually replicate the issue and got the same results. Now I am just trying to understand WHY?</P> Fri, 14 Oct 2016 13:30:26 GMT https://community.splunk.com/t5/Splunk-Search/Result-differences/m-p/254675#M176464 tinylund 2016-10-14T13:30:26Z https://community.splunk.com/t5/Splunk-Search/Result-differences/m-p/254676#M176465 <P>I understand that </P> <P>WinTempFieldType=* | search WinTempFieldType=Error </P> <P>is a search within a search and would take longer...and I'm really not concerned with time, the number of results found is the most important, by is there such (any) difference.</P> Fri, 14 Oct 2016 17:36:11 GMT https://community.splunk.com/t5/Splunk-Search/Result-differences/m-p/254676#M176465 tinylund 2016-10-14T17:36:11Z