Splunk Search

What’s wrong with Splunk search?

mehrdad_2000
Path Finder

Hi

I have several log files that add to Splunk, now try to search this string:

index="Myindex" | search "HQL query plan in cache (select i from table1 i where"

splunk return 198 events but when i try to grep on the shell return 242!

 

FYI 1: time scope set to “all time”

FYI 2: index process completed.

Thanks,

 

Labels (4)
Tags (1)
0 Karma

bowesmana
Champion

You will need to first validate that you have ingested the log files correctly. If you have different results from the grep and the Splunk search, then it should be easy enough to drill into that 198/242 discrepancy by looking at smaller and smaller sections to narrow down where the results are out of sync.

 

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!