Records count in dashboard charts is not matching with the records count in dashboard table where same query is used

[pasokkum]

Hi Team,

We have created a custom dashboard in Splunk. Records count in dashboard charts is not matching with the records count in dashboard table where same query is used.It is showing less number of records for all time and more records for a particular time range.

Please let us know how we can resolve this issue

Thanks,
Soumya

[mcronkrite]

Which App Search Context are you using.
For example if you are in the Green Search and Reporting an do a search vs being in the Blue Palo Alto App.
Apps have different permissions on fields. So your query might be referencing a fields from Palo Alto that does not have global scope.

Also are you in Fast, Smart or Verbose mode?
Fast mode means only the | stats fields are brought back.
Smart mode means the fields that you have explicitly downloaded apps for apply, when in the right app context.
And Verbose means no fields are explicitly setup and Splunk is learning the key values on the fly.

Are you running as the same user in both cases?

[woodcock]

Post the search AND both URLs (everything after .../app/). Then I will be able to answer your question.

[somesoni2]

Could you provide the query that you're using ? I've seen Splunk dropping events, with no error if the query is very complex/expensive, due to high memory usage by search.

[pradeepkumarg]

Does the chart panel have any warning or error message about truncating the data because of hitting some limits? Try running the search independently to find any clue in the job inspector.