Splunk Enterprise Security

Difference between the results from a visualizations and a regular search

cristiad
New Member

Hi there,

I have a strange situation. When I'm using a base search into a dashboard, I have displayed only 4 devices even if when I run the query as a regular search in search app I obtain a greater value.

Any ideas?

Thank you!

alt text

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

This seems like you might have a knowledge object { field extraction or a lookup } that isnt set to export globally.

Can you share your base search?

,This sounds to me like you have some knowledge objects { lookup, field extraction } that dont have global permissions or is exported outside of an app context..

Can you share your base search?

0 Karma

niketnilay
Legend

@cristiad by base search do you imply you are using Post-Processing? Is the final command in your base search a transforming command or streaming command? Will you be able to provide the query for existing dashboard?

Make sure that you do not return all the fields using base search for post-processing and rather use transforming commands like stats. Refer to Splunk Docs for Post-Processing Best Practices.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nadlurinadluri
Communicator

Can you please elaborate on this? Are you saying that you are using the same query and getting different results when you run it as adhoc regular search and when it is in a dashboard?

0 Karma

cristiad
New Member

Yes, the same search is used and I obtain different results.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.