Difference between the results from a visualizations and a regular search

[cristiad]

Hi there,

I have a strange situation. When I'm using a base search into a dashboard, I have displayed only 4 devices even if when I run the query as a regular search in search app I obtain a greater value.

Any ideas?

Thank you!

[esix_splunk]

This seems like you might have a knowledge object { field extraction or a lookup } that isnt set to export globally.

Can you share your base search?

,This sounds to me like you have some knowledge objects { lookup, field extraction } that dont have global permissions or is exported outside of an app context..

Can you share your base search?

[niketn]

@cristiad by base search do you imply you are using Post-Processing? Is the final command in your base search a transforming command or streaming command? Will you be able to provide the query for existing dashboard?

Make sure that you do not return all the fields using base search for post-processing and rather use transforming commands like stats. Refer to Splunk Docs for Post-Processing Best Practices.

[nadlurinadluri]

Can you please elaborate on this? Are you saying that you are using the same query and getting different results when you run it as adhoc regular search and when it is in a dashboard?

[cristiad]

Yes, the same search is used and I obtain different results.