Knowledge Management

summary index vs search query

srinathd
Contributor

Hi,

why sometimes there is a difference between summary index results and normal search query restuls for the same day? why it happens? and how to avoid this?

1 Solution

_d_
Splunk Employee
Splunk Employee

Provided that the searches that you run on raw index and summary index are equivalent, the results should be the same. Unless there are gaps or duplicates in your summary index.
If you could give more details around the background of the question; summary populating search, actual search query, difference in results, example etc. we should be able to help you better.

View solution in original post

somesoni2
Revered Legend

I am not sure if this is applicable in your situation, but I have faced similar issues of count of actual events not matching with event count in summary index due to a bug in Splunk version 5.0.3 or earlier. Please refer to this question. This bug was fixed in 5.0.5 and higher version. Worth looking.

http://answers.splunk.com/answers/94725/issue-with-summary-indexing-saved-searches-runs-fine-but-sum...

srinathd
Contributor

Is this issue resolved in version 5.0.4?

0 Karma

_d_
Splunk Employee
Splunk Employee

Provided that the searches that you run on raw index and summary index are equivalent, the results should be the same. Unless there are gaps or duplicates in your summary index.
If you could give more details around the background of the question; summary populating search, actual search query, difference in results, example etc. we should be able to help you better.

Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...