Splunk Search

Different number of events same query

splunkcol
Builder

I have 2 servers that receive the logs through Syslog and through a universal forwarder I forward them to 2 indexers.

I have 2 search heads that are not in cluster mode, they are in "Standalone"

Only Splunk Enterprise is installed in one search head, and Splunk Enterprise and Splunk Enterprise Security are installed in the other.

For obvious reasons, they both have the peer pointing to both indexers.

What makes me curious is why if I make a query of any type of Query SPL in the search head where Splunk ES is, it shows that it went to search more logs than in the search head where I only have Splunk.


splunkcol_0-1620357885041.png

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunkcol,

there is no reason for the behavior you said.

the only question I can ask you is the following: what is the execution time range of the two searches?

try to set the same time range but always in the past, never using "until now" (latest = now).

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @splunkcol,

there is no reason for the behavior you said.

the only question I can ask you is the following: what is the execution time range of the two searches?

try to set the same time range but always in the past, never using "until now" (latest = now).

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...