All Apps and Add-ons

Append and lookup

Explorer

Hello,
We have 2 log files with a coloum in common. I saved the first search and use "lookup" to connect it to the second search.
While my colleague, he use "append". We got two very close result, but they are not the same. Just 1 or 2 different in the total number in the result. Could anybody told me, whose search is more precise? Or under what circumustance, "lookup", or "append", is more precise ?

Thank you very much.

0 Karma

SplunkTrust
SplunkTrust

In general, both variants are precise. However, lookup uses data saved before, so it might be a little less recent than append, simply because the data has changed in the meantime.

If your data did not change inbetween, I would try to do a search in the results, to find out what exactly makes for those "off by 1-2" differences - because then they should yield the same results.

0 Karma