Splunk Search

Event mismatch to different forwarding servers?


We re-routed data from Splunk SaaS cloud to On-perm but we see event mismatch between these two instances, if I route the date to Splunk cloud all the sudden the event count increases but when I re-route the same data source to on-perm drastically the event count comes down for the same time period but don't see any error in the FW. 

Fw-->Splunk SaaS more count.

Fw-->Splunk On-Perm less count. 

Please find the screenshot and let me know what would be the issue and troubleshoot to fix this count mismatch. Thanks.




Tags (3)
0 Karma

Esteemed Legend

Hi @sathiyasun,

maybe there's a delay in data forwarding,

please run the same search using an old time period: e.g. yesterday or earliest=-4h@h latest=-3h@h.



0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...