What does normalized search in the job inspector do? How is it different from an actual search?

[OMohi]

What does normalized search in the job inspector do. How is it different from an actual search? Please let me know.

Thanks

[woodcock · Accepted solution]

The normalized search is your "actual search"; it is the fully-qualified, maximally-optimized (very questionable in many cases, to be sure) search string exactly as it is sent to your indexers. In fact, you can take the normalized search and use it in the search bar and it will give you the same results (and the same normalized search) as your original search. If you would like to see more clearly how your Knowledge Objects effect the translation of your raw search into the normalized search, I recommend that you try the Knowledge Object Explorer app:

https://splunkbase.splunk.com/app/2871/