topic Re: Summary incorrect on search page in Splunk Search

Summary incorrect on search page

splunkranger — Fri, 28 Mar 2014 19:09:02 GMT

The 'Search' page, which lists the number of events, the oldest and latest event is not accurate.

Can anyone tell me where this information is being collected from?

Re: Summary incorrect on search page

somesoni2 — Fri, 28 Mar 2014 19:16:01 GMT

| metadata type=sourcetypes | search totalCount>0 | rename totalCount as Count | stats sum(Count) as "INDEXED" min(firstTime) as "EARLIEST EVENT" max(lastTime) as "LATEST EVENT"

Re: Summary incorrect on search page

splunkranger — Fri, 28 Mar 2014 20:01:38 GMT

This looks correct when I run it, can the results be effected by a users security role?

Re: Summary incorrect on search page

somesoni2 — Fri, 28 Mar 2014 20:14:21 GMT

Yes, the search shows stats from the indexes to which user has access to.

Re: Summary incorrect on search page

martin_mueller — Fri, 28 Mar 2014 20:28:18 GMT

Does it use indexes the user has access to or indexes the user searches by default?

Re: Summary incorrect on search page

somesoni2 — Fri, 28 Mar 2014 20:55:43 GMT

My bad, its indexes the users searches by default. Thanks @Martin for correction

Re: Summary incorrect on search page

splunkranger — Fri, 28 Mar 2014 20:57:10 GMT

This jives.

Thank you!

Re: Summary incorrect on search page

marcoscala — Sat, 29 Mar 2014 13:02:54 GMT

First of all, you will see events just from your 'default' indexes, depending on the User's role, as someoni2 said.

Then, if you have strange dates as newest or late see bent, this means that there's a time stamp problem: so if you see events in the future, check for events in that time range and check of time stamp in the event is translated. The same if you have events older than they are supposed to be. It's a quite common problem, if Imunderstood right your question.

Happy Splunking,
Marco