Knowledge Management

how to know that splunk is giving accurate results?

sahoo0233
Path Finder

I am using splunk enterprise 5.0 in linux environment

So i want to know if splunk is giving accurate results or not. how to check it?

I have tried checking it in shell by using zgrep -c for rawlogs, but the counts are not matching with the counts i got in splunk web interface

i know that linux doesnt give accurate results.
so how do we know?

Tags (1)
0 Karma

lukasz92
Communicator

Both linux and Splunk give accurate results - they are just doing what you want to do.
If your queries or commands are inaccurate - results will not satisfy you.

Maybe you have to look into limits.conf, understand Splunk internals and search process?

You have to know what do you want, how you understand the word "accurate".
You always have to do verification on your own - if you don't trust.

0 Karma

sahoo0233
Path Finder

As far as i check linux will give accurate counts, i used the below command to check the counts with the raw logs
zgrep -c myfiltered_15_01_08_5.gz which gives me the counts...

But the counts here dont match with splunk counts

0 Karma

tom_frotscher
Builder

Hi,

is zgrep -c counting the lines of the logfile? If so, can you gurantee, that ever logentry is only one line? Can you guarantee that your input and props are correct for this sourcetype?

You didn't mention how or what you count in splunk. Give us some more infos, so we can help 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...