Splunk Search

Scheduled search returns different results

jrfreeze
Explorer

There are two ways users can register for our site and I'm trying to track how many registered in the last quarter. When I run this search manually, it catches all the results from both sources. When it runs as scheduled search, the normal way it will be used for the dashboard, it only catches the results from the second one (meaning the second rex line). When I reverse the order of the rex commands, I get the results from the other one.

host="our.host.com" ("Attempting new user registration" OR "Creating local user record") |
rex "\'username\':\s+u\'(?[\w\d_]+)\'" |
rex "Creating local user record for \"(?[\w\d_]+)\"" |
stats dc(newuser) AS "New Users"

Any thoughts?

Tags (1)
0 Karma

jrfreeze
Explorer

Well, I figured out a solution to my problem, although it isn't especially elegant. I put in a sed command changing one text match into the other and just counted that one:

host="our.host.com" ("Attempting new user registration" OR "Creating local user record")
| rex mode=sed "s/\'username\':\s+u\'([\w\d_]+)\'/Creating local user record for \"\1\"/"
| rex "Creating local user record for \"(?[\w\d_]+)\""
| stats dc(newuser) AS "New Users"

Now I get the same results whether I run the search directly or it runs on a schedule as I would expect.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...