Splunk Search

Different Results From Same Query

jack_sumatra
Engager

I have question.

 

Can anyone explain why same search query given different results in different time range?

This is time range between 2021-02-24, hour 08:00:00 to 10:59:59

image_2021-02-24_133247.png

 

This is time range between 2021-02-24, hour 09:00:00 to 09:59:59

image_2021-02-24_133355.png

 

Why the result on hour 09:00:00 different, one show 81 and the other one 387.

 

Thank you

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jack_sumatra,

Have you the same events in both the time periods?

probably you have different events in the second one so you have a different result, it isn't a strange behaviour. 

Ciao.

Giuseppe

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on