Splunk Search

Is base search will ignore events

kirrusk
Communicator

I'm using base search in my dashboard,
In dashboard panels , one created using base search query and other one is using normal query.
but base search one is giving three events less than the normal query( Which is correct and accurate).
So i doubted that base search will ignore event's if it will take more time to run query.

(here i'm trying to count the events based on specific fields)

If any one knows please clarify.

And one more thing , but sometimes base search is also giving accurate results(but it's very rare, one time only i saw).

0 Karma

woodcock
Esteemed Legend

We need your entire dashboard.

0 Karma

niketn
Legend

@kirrusk Yes it is expected that Post Processing Base search may drop events silently if there are events greater than that configured in limits.conf. By default 500K events.

So there are certain best practices around use of Base Search for post-processing. Please refer to Splunk documentation to know about both of these: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Use_a_transforming_base_search

[UPDATED] default limit is 500K not 50K. Thanks for the correction @nplamondon 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

woodcock
Esteemed Legend

A base search is NOT a subsearch and is not under those limits.

0 Karma

nplamondon
Communicator

@niketnilay is off by 10x, but otherwise correct.

If the base search is a non-transforming search, the Splunk platform retains only the first 500,000 events that it returns.

niketn
Legend

Thanks for pointing it out @nplamondon . I have corrected the default limit 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share your base search.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...