Getting Data In

Why do the results exported to CSV not match total number of events?

lohitkidu
Path Finder

Hi ,

I have a search without any statistic/transformation command like index=abc earliest=-7d. I am getting following information on events:
1. Total Events:689 (in timeline and eventCount in Job Inspector)
2. Events in "Events Section": If I navigate through all pages then there are total of 657 events and eventAvailableCount in Job Inspector.
3. If I export results to CSV then there are only 650 rows.

I get that if I do not use statistic/transformation command, then difference in point 1 and point 2 is valid. But the field in eventAvailableCount in the Job inspector shows the events available for export which should be 657. However, when I export results to CSV, only 650 rows are exporting?

Any idea why is this happening?

0 Karma

javiergn
Super Champion

If you run the same search but specifying an end time, such as:

index=abc earliest=-7d latest=-1h@h

Does it still happen?

0 Karma

lohitkidu
Path Finder

Yes it is still happening. after adding latest=-1h@h to the search i got the following
1. events on Timeline: 422
2. Events on "Events Section" : 384
3. CSV results: 387

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...