Getting Data In

Why Splunk showing event count mismatch?

rajuljain1990
Explorer

When I see number of events in Forwarder server it shows me total line count 24130
cat /opt/xxt/xx/*gz | zgrep ST-xxxx | grep identity | wc -l
24130

When I do the same search from Splunk , it shows the event count 24018
Index= main sourcetype=xx ST-xxxx identity
I got following result:
24018 events(15/02/2015 00:00:00:000 to 16/02/2015 00:00:00:000)

Why Splunk showing less evets?

splunker545
Engager

Hey rajuljain1990, have you find any solution for this , i am having similar problem here , please post here , if your issue has been resolved!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Check @woodcock's answer first, if everything is okay there then we need to see your source of input props.conf and transforms.conf related to that. As with props.conf and transforms.conf events can be ignored conditionally.

0 Karma

woodcock
Esteemed Legend

Some events may have expired and been removed but more likely you are not running your search for All Time and some events are mis-timestamped so that they are in the future (which most versions of Splunk include inside All Time but I have heard that some versions of All Time use latest=now). These future events should never happen (but trust me: they do) and will only show up if you do a search for All Time (or use latest=999999999). If this is the problem, you most likely have a TIMEZONE issue.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...