Knowledge Management

summary index vs search query

srinathd
Contributor

Hi,

why sometimes there is a difference between summary index results and normal search query restuls for the same day? why it happens? and how to avoid this?

1 Solution

_d_
Splunk Employee
Splunk Employee

Provided that the searches that you run on raw index and summary index are equivalent, the results should be the same. Unless there are gaps or duplicates in your summary index.
If you could give more details around the background of the question; summary populating search, actual search query, difference in results, example etc. we should be able to help you better.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

I am not sure if this is applicable in your situation, but I have faced similar issues of count of actual events not matching with event count in summary index due to a bug in Splunk version 5.0.3 or earlier. Please refer to this question. This bug was fixed in 5.0.5 and higher version. Worth looking.

http://answers.splunk.com/answers/94725/issue-with-summary-indexing-saved-searches-runs-fine-but-sum...

srinathd
Contributor

Is this issue resolved in version 5.0.4?

0 Karma

_d_
Splunk Employee
Splunk Employee

Provided that the searches that you run on raw index and summary index are equivalent, the results should be the same. Unless there are gaps or duplicates in your summary index.
If you could give more details around the background of the question; summary populating search, actual search query, difference in results, example etc. we should be able to help you better.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...