summary index vs search query

[srinathd]

Hi,

why sometimes there is a difference between summary index results and normal search query restuls for the same day? why it happens? and how to avoid this?

[somesoni2]

I am not sure if this is applicable in your situation, but I have faced similar issues of count of actual events not matching with event count in summary index due to a bug in Splunk version 5.0.3 or earlier. Please refer to this question. This bug was fixed in 5.0.5 and higher version. Worth looking.

http://answers.splunk.com/answers/94725/issue-with-summary-indexing-saved-searches-runs-fine-but-sum...

[srinathd]

Is this issue resolved in version 5.0.4?

[_d_ · Accepted solution]

Provided that the searches that you run on raw index and summary index are equivalent, the results should be the same. Unless there are gaps or duplicates in your summary index.
If you could give more details around the background of the question; summary populating search, actual search query, difference in results, example etc. we should be able to help you better.