Knowledge Management

how to know that splunk is giving accurate results?

sahoo0233
Path Finder

I am using splunk enterprise 5.0 in linux environment

So i want to know if splunk is giving accurate results or not. how to check it?

I have tried checking it in shell by using zgrep -c for rawlogs, but the counts are not matching with the counts i got in splunk web interface

i know that linux doesnt give accurate results.
so how do we know?

Tags (1)
0 Karma

lukasz92
Communicator

Both linux and Splunk give accurate results - they are just doing what you want to do.
If your queries or commands are inaccurate - results will not satisfy you.

Maybe you have to look into limits.conf, understand Splunk internals and search process?

You have to know what do you want, how you understand the word "accurate".
You always have to do verification on your own - if you don't trust.

0 Karma

sahoo0233
Path Finder

As far as i check linux will give accurate counts, i used the below command to check the counts with the raw logs
zgrep -c myfiltered_15_01_08_5.gz which gives me the counts...

But the counts here dont match with splunk counts

0 Karma

tom_frotscher
Builder

Hi,

is zgrep -c counting the lines of the logfile? If so, can you gurantee, that ever logentry is only one line? Can you guarantee that your input and props are correct for this sourcetype?

You didn't mention how or what you count in splunk. Give us some more infos, so we can help 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...