Is base search will ignore events

[kirrusk]

I'm using base search in my dashboard,
In dashboard panels , one created using base search query and other one is using normal query.
but base search one is giving three events less than the normal query( Which is correct and accurate).
So i doubted that base search will ignore event's if it will take more time to run query.

(here i'm trying to count the events based on specific fields)

If any one knows please clarify.

And one more thing , but sometimes base search is also giving accurate results(but it's very rare, one time only i saw).

[woodcock]

We need your entire dashboard.

[niketn]

@kirrusk Yes it is expected that Post Processing Base search may drop events silently if there are events greater than that configured in limits.conf. By default 500K events.

So there are certain best practices around use of Base Search for post-processing. Please refer to Splunk documentation to know about both of these: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Use_a_transforming_base_search

[UPDATED] default limit is 500K not 50K. Thanks for the correction @nplamondon 🙂

[woodcock]

A base search is NOT a subsearch and is not under those limits.

[nplamondon]

@niketnilay is off by 10x, but otherwise correct.

If the base search is a non-transforming search, the Splunk platform retains only the first 500,000 events that it returns.

[niketn]

Thanks for pointing it out @nplamondon . I have corrected the default limit 🙂

[richgalloway]

Please share your base search.