Splunk Search
Highlighted

Why does adding a comment change the number of rows returned by a search?

New Member

Using Splunk Enterprise 7.3.2 on a MacBook.
Two searches on the same static (loaded-once) search index, same date range, with or without other qualifiers return a different number of results when a comment is added vs when it is not.

See attached screenshots. With a comment returns 5 rows, without the (correct) 500K+ rows. What am I missing here?

alt text

0 Karma
Highlighted

Re: Why does adding a comment change the number of rows returned by a search?

New Member
0 Karma
Highlighted

Re: Why does adding a comment change the number of rows returned by a search?

Esteemed Legend

You could figure this out if you tapped SHIFT-CTRL-E for Expand Macro and you would see that this reduced down to:

(index=* search)

which is incorrect. If you get rid of the search, it works as you would expect.

0 Karma