Splunk Search

Weird event number for differing time scope

githubguthub
Loves-to-Learn

1day.png

 

 

 

 

3day.png4day.png

source="main" service="sales" operation="inquiryV3" port="8443"

2day.png

 

 

 

In these screenshots, there's no change in the query at allquery is very simple, so something like:

 

 

field1="a" field2="b" field3="c"

 

 

all are fixed string, no weird syntax or variable at all, completely basic field-based search

all searches always start on 29 okt 12AM and we're only interested in 29 okt 12AM bar.

first search covers until EOD (23:59:59) 29 okt, yields 703 events

second one covers till EOD 30 okt, yields 752

third is till EOD 31 okt, yields 580

and last one, EOD 1 Nov, yields 642

How is this possible? what am I missing here?

 

Thanks in advance

Labels (2)
0 Karma

nwuest
Path Finder

Hi @githubguthub,

I was mainly speaking to getting a screenshot of the query AND results.
It would just help us to see what you are looking at specifically in relation with the search and results.

I have yet to find/have a similar instance in Splunk where the search results are going lower with a larger search window so I'm genuinely interested in your challenge.

Hope to hear from you soon!

V/R,
nwuest

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Insufficient information. Please provide the queries for these charts. I noticed that the overall shapes are subtly different so it is not just about the number of the first bar.

0 Karma

githubguthub
Loves-to-Learn

Thanks for the reply @ITWhisperer 

 

source="main" service="sales" operation="inquiryV3" port="8443"

 

this is the query used in searches

 

 

0 Karma

nwuest
Path Finder

Hi @githubguthub,

To follow @ITWhisperer’s sentiment, is there a way you could provide the results with the search query so we can see the diffferences with each search? 
It’s not a lot to go off of with just screenshots of the results but no query. 

We definitely look forward to hearing back from you so we can help troubleshoot further!

V/R,
nwuest

0 Karma

githubguthub
Loves-to-Learn

@nwuest 

Hi, this is the query

 

source="main" service="sales" operation="inquiryV3" port="8443"

 

beyond that, I'm only tweaking with the time scope :

search 1 --> 29 okt Start of Day (12AM) - 29 okt EOD (23:59:59)

search 2 --> 29 okt 12AM - 30 okt EOD

3 --> 29 okt 12AM - 31 okt EOD

4 --> 29 okt 12AM - 1 Nov EOD

 

Please let me know if you need anything else 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...