Splunk Search

Different Results From Same Query

jack_sumatra
Engager

I have question.

 

Can anyone explain why same search query given different results in different time range?

This is time range between 2021-02-24, hour 08:00:00 to 10:59:59

image_2021-02-24_133247.png

 

This is time range between 2021-02-24, hour 09:00:00 to 09:59:59

image_2021-02-24_133355.png

 

Why the result on hour 09:00:00 different, one show 81 and the other one 387.

 

Thank you

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jack_sumatra,

Have you the same events in both the time periods?

probably you have different events in the second one so you have a different result, it isn't a strange behaviour. 

Ciao.

Giuseppe

0 Karma