Getting Data In

Why Splunk showing event count mismatch?

rajuljain1990
Explorer

When I see number of events in Forwarder server it shows me total line count 24130
cat /opt/xxt/xx/*gz | zgrep ST-xxxx | grep identity | wc -l
24130

When I do the same search from Splunk , it shows the event count 24018
Index= main sourcetype=xx ST-xxxx identity
I got following result:
24018 events(15/02/2015 00:00:00:000 to 16/02/2015 00:00:00:000)

Why Splunk showing less evets?

splunker545
Engager

Hey rajuljain1990, have you find any solution for this , i am having similar problem here , please post here , if your issue has been resolved!

0 Karma

VatsalJagani
Motivator

Check @woodcock's answer first, if everything is okay there then we need to see your source of input props.conf and transforms.conf related to that. As with props.conf and transforms.conf events can be ignored conditionally.

0 Karma

woodcock
Esteemed Legend

Some events may have expired and been removed but more likely you are not running your search for All Time and some events are mis-timestamped so that they are in the future (which most versions of Splunk include inside All Time but I have heard that some versions of All Time use latest=now). These future events should never happen (but trust me: they do) and will only show up if you do a search for All Time (or use latest=999999999). If this is the problem, you most likely have a TIMEZONE issue.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!