.csv file does not contain all data

JYTTEJ — Mon, 11 Apr 2011 19:19:54 GMT

I have set up a scheduled report which select current month data.

I have set up the report to be sent as a .csv file to a number of e-mail adresses. The same report is also included in a DashBoard as a table.

In the start of the month the number of data is same in the .csv file and in the DashBoard

But in the middle of the month the .csv file does not contain ALL data - whereas the report shown in the DashBoard do contain all data.

Has somebody else experienced this? - and do you have an explanation - and hopefully a solution?

The setup is as follows:

Schedule type= Basic

Run every day at midnight

Perform actions: always

Alert actions: Send E-mail

Include results in e-mail

Re: .csv file does not contain all data

hazekamp — Fri, 15 Apr 2011 19:38:36 GMT

There could be a number of reasons why a report generated by the "scheduler" (alerts) vs. a dashboard, but the most common are related to permissions and timestamping. If timestamps (_time) in your data are being extracted incorrectly, or with great enough drift you could see discrepencies between scheduled and dashboard based searches.

Without having some specifics around your configurations this is a bit tricky to answer. There is also some weirdness related to why this works part of the month, but not in the middle.... I would recommend opening a case with support if this is still an issue for you.

topic .csv file does not contain all data in Splunk Search

.csv file does not contain all data

Re: .csv file does not contain all data