Splunk Search

Basic search doesn't return consistent data

fdederichs
Engager

I'm doing a simple query into splunk to retrieve some data:

index=my_index
|table source,host

I've also put a specific timestamp using the "date & time range" tab, the query return around 19K events/lines.
The issue is that the query 'miss' some data (around 300 events/lines in total), data that appears when I'm lowering the time range or when I'm being more specific in the filtering of my query as such:

index= my_index host=a_specific_host
|table source,host

Then the previously missing data are shown. One thing to notice is that the missing data aren't random, there are always the same.
Do you have any idea on what could cause the issue ?
I'm running Splunk Enterprise Version: 7.2.3

Regards

Tags (1)

woodcock
Esteemed Legend

Does it always work if you do not use | table source host?

0 Karma

woodcock
Esteemed Legend

I would definitely open a support case.

0 Karma

fdederichs
Engager

I did that too

0 Karma

woodcock
Esteemed Legend

Be sure to post back what you find.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...