Knowledge Management

summary index vs search query

srinathd
Contributor

Hi,

why sometimes there is a difference between summary index results and normal search query restuls for the same day? why it happens? and how to avoid this?

1 Solution

_d_
Splunk Employee
Splunk Employee

Provided that the searches that you run on raw index and summary index are equivalent, the results should be the same. Unless there are gaps or duplicates in your summary index.
If you could give more details around the background of the question; summary populating search, actual search query, difference in results, example etc. we should be able to help you better.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

I am not sure if this is applicable in your situation, but I have faced similar issues of count of actual events not matching with event count in summary index due to a bug in Splunk version 5.0.3 or earlier. Please refer to this question. This bug was fixed in 5.0.5 and higher version. Worth looking.

http://answers.splunk.com/answers/94725/issue-with-summary-indexing-saved-searches-runs-fine-but-sum...

srinathd
Contributor

Is this issue resolved in version 5.0.4?

0 Karma

_d_
Splunk Employee
Splunk Employee

Provided that the searches that you run on raw index and summary index are equivalent, the results should be the same. Unless there are gaps or duplicates in your summary index.
If you could give more details around the background of the question; summary populating search, actual search query, difference in results, example etc. we should be able to help you better.

Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...