topic Re: Howcome additional condition increases result count? in Splunk Search

Howcome additional condition increases result count?

shai — Wed, 11 Oct 2023 05:09:18 GMT

my question is very simple.

This returns nothing:

sourcetype=my_sourcetype

This returns X amount of events (same amount as index=my_index):

index=my_index AND sourcetype=my_sourcetype

Search is in: Verbose Mode
what am I missing?!
howcome another filter returns more events?

Re: Howcome additional condition increases result count?

gcusello — Wed, 11 Oct 2023 06:25:33 GMT

Hi @shai,

this means that your index isn't in the search default path for your role [Settings > Roles > your_role > Indexes].

Anyway, it's always a best practice to use the index filter in every search, trying to limit the indexes to only the ones where the log to search are stored: this approach redduces the time search.

Ciao.

Giuseppe

Re: Howcome additional condition increases result count?

shai — Thu, 12 Oct 2023 11:01:18 GMT

Hi @gcusello
Thank you for your response

However it does not explain the odd behaviour because I use admin Role and in the setting page that you have referred me to, all the indices are included. So can you explain what else I might be missing?

Note that I witnessed this issue not only with indexes but with sourcetype.
for example searching for field=value yielded zero results but searching field=value AND sourcetype=certail_type did return results...

Re: Howcome additional condition increases result count?

gcusello — Thu, 12 Oct 2023 11:58:22 GMT

Hi @shai,

which Mode are you using in your searches?

did you try to use Verbose Mode?

Ciao.

Giuseppe

Re: Howcome additional condition increases result count?

shai — Thu, 12 Oct 2023 13:26:57 GMT

hi @gcusello
as written in the original post the mode is Verbose.

Re: Howcome additional condition increases result count?

gcusello — Thu, 12 Oct 2023 13:53:16 GMT

Hi @shai ,

in the [Settings > Roles > Indexes] Tab, are your index flagged also in the Default column?

Ciao.

Giuseppe

Re: Howcome additional condition increases result count?

shai — Thu, 12 Oct 2023 14:45:07 GMT

@gcusello
marking as default solved the issue. thank you very much.

Re: Howcome additional condition increases result count?

gcusello — Thu, 12 Oct 2023 14:50:07 GMT

Hi @shai,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉