I am having some inconsistent search results and I'm not terribly sure why.
earliest=-7d latest=-2h sourcetype=x type=delta status=fatal | ctable type status
type fatal TOTAL 1 delta 658 658 2 TOTAL 658 658
earliest=-7d latest=-2h sourcetype=x type=* status=fatal | ctable type status
type fatal TOTAL 1 delta 861 861 2 full 34 34 3 TOTAL 895 895
The searches are running over the same period of time but returning differing results. I've confirmed that all my indexers are available.
what results do you get if you change your first search to: earliest=-7d latest=-2h sourcetype=x status=fatal | search type=delta | ctable type status
When you search for
type=delta in part of the search before the first pipe character, we use the heuristic optimization that the value of the field/value comparison, here
delta is indexed. I presume that this heuristic fails here. You can fix this by changing "type" in fields.conf to not be an indexed field, at the consequence of some searches being slower.
You can find the problematic events using:
earliest=-7d latest=-2h sourcetype=x NOT delta status=fatal | search type=delta