Why is Splunk giving different result when searching on _bkt field?

bhavikbhalodia — Fri, 18 Aug 2023 18:12:55 GMT

While running below search I am not getting any events:

index=main_vulnerability_database sourcetype=vulnerability_overview _bkt="main_vulnerability_database~0~FB1A6C9D-87F2-4A38-B420-94F2171CE493" _cd=0:1015

But while adding search command I am getting events:

index=main_vulnerability_database sourcetype=vulnerability_overview

| search _bkt="main_vulnerability_database~0~FB1A6C9D-87F2-4A38-B420-94F2171CE493" _cd=0:1015

Ideally both should give same results. Looking for reason why it is happening.

Re: Splunk is giving different result when searching on _bkt field

isoutamo — Fri, 18 Aug 2023 13:37:36 GMT

if I recall right splunk is not supporting to use (most) _xyz fields on base search. Some of those works with separate search/where command. Also some of those needs to copy to another fields to use/show on results (e.g. _indextime).

r. Ismo

topic Re: Splunk is giving different result when searching on _bkt field in Splunk Search

Why is Splunk giving different result when searching on _bkt field?

Re: Splunk is giving different result when searching on _bkt field