Splunk Search

Different number of events same query

splunkcol
Builder

I have 2 servers that receive the logs through Syslog and through a universal forwarder I forward them to 2 indexers.

I have 2 search heads that are not in cluster mode, they are in "Standalone"

Only Splunk Enterprise is installed in one search head, and Splunk Enterprise and Splunk Enterprise Security are installed in the other.

For obvious reasons, they both have the peer pointing to both indexers.

What makes me curious is why if I make a query of any type of Query SPL in the search head where Splunk ES is, it shows that it went to search more logs than in the search head where I only have Splunk.


splunkcol_0-1620357885041.png

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunkcol,

there is no reason for the behavior you said.

the only question I can ask you is the following: what is the execution time range of the two searches?

try to set the same time range but always in the past, never using "until now" (latest = now).

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @splunkcol,

there is no reason for the behavior you said.

the only question I can ask you is the following: what is the execution time range of the two searches?

try to set the same time range but always in the past, never using "until now" (latest = now).

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...