What is the difference between the dbinspect command and "_bkt"?

[splunkreal]

Hello guys,

Could you let me know the difference in terms of buckets between :

| dbinspect *search* and *search* | eval bkt=_bkt | table bkt ?
It looks like dbinspect returns more results and with a wider span. My aim is to remove buckets according to a specific search and timeframe.

Thanks.

[splunkreal · Accepted solution]

Solved by support :

dbinspect take it data from the metadata
_bkt from from the search process.

the metadata can be update when we search but you
will search on your old generation id.

[gjanders]

Can you accept your answer please? That will make this clear that you've answered your own question

[splunkreal]

"We're sorry, but you cannot vote on your own post." 🙂

[gjanders]

Correct, but as per How to earn Karma you will get some points and you can up-vote anyone else's posts 🙂

[gjanders]

What are you trying to achieve by removing buckets?
You've also only posted a single search query mentioning dbinspect, dbinspect lists buckets on a per-index basis including replicated buckets.