Using Splunk Enterprise 7.3.2 on a MacBook.
Two searches on the same static (loaded-once) search index, same date range, with or without other qualifiers return a different number of results when a comment is added vs when it is not.
See attached screenshots. With a comment returns 5 rows, without the (correct) 500K+ rows. What am I missing here?
You could figure this out if you tapped SHIFT-CTRL-E for Expand Macro
and you would see that this reduced down to:
(index=* search)
which is incorrect. If you get rid of the search
, it works as you would expect.