topic Re: Bug ? search result problem in Splunk Search

Bug ? search result problem

tardieuxth — Mon, 28 Apr 2014 10:19:46 GMT

Hello,
We encounter a problem during search.

A search result differ from finding the results expected and not finding anything

the only change is the time period.

From 06:00:00 to 09:00:00 it's finding the result expected but between 06:13:00 to 09:10:00 nothing is find (see screenshots)

link text
link text

Re: Bug ? search result problem

Matthias_BY — Mon, 28 Apr 2014 10:39:35 GMT

Hi Tardieu,

can you copy + paste or upload the info shown in the job inspector?
http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/ViewsearchjobpropertieswiththeJobInspector

There we should find the cause.

br
Matthias

Re: Bug ? search result problem

Matthias_BY — Mon, 28 Apr 2014 10:43:41 GMT

Hi,

i just did had a second look at your screenshots. The first search does have time beginning at 6:13 am and the second search with results starts at 6:00 am. if i review the timeline with the bars of the successful search it can really be that all events have been in the timeframe between 6:00 - 6:13. 😉

Re: Bug ? search result problem

tardieuxth — Mon, 28 Apr 2014 11:31:21 GMT

the searched was in course when I did the screenshot 🙂

by working to find out why my search wasn't working, we supposed that there is too much data to index and that it takes longer than expected to be treated.

I'll try in a few hours to see if we are true or not