how to know that splunk is giving accurate results?

[sahoo0233]

I am using splunk enterprise 5.0 in linux environment

So i want to know if splunk is giving accurate results or not. how to check it?

I have tried checking it in shell by using zgrep -c for rawlogs, but the counts are not matching with the counts i got in splunk web interface

i know that linux doesnt give accurate results.
so how do we know?

[lukasz92]

Both linux and Splunk give accurate results - they are just doing what you want to do.
If your queries or commands are inaccurate - results will not satisfy you.

Maybe you have to look into limits.conf, understand Splunk internals and search process?

You have to know what do you want, how you understand the word "accurate".
You always have to do verification on your own - if you don't trust.

[sahoo0233]

As far as i check linux will give accurate counts, i used the below command to check the counts with the raw logs
zgrep -c myfiltered_15_01_08_5.gz which gives me the counts...

But the counts here dont match with splunk counts

[tom_frotscher]

Hi,

is zgrep -c counting the lines of the logfile? If so, can you gurantee, that ever logentry is only one line? Can you guarantee that your input and props are correct for this sourcetype?

You didn't mention how or what you count in splunk. Give us some more infos, so we can help 🙂