Splunk Search

Why does adding a comment change the number of rows returned by a search?

bretlowery1
New Member

Using Splunk Enterprise 7.3.2 on a MacBook.
Two searches on the same static (loaded-once) search index, same date range, with or without other qualifiers return a different number of results when a comment is added vs when it is not.

See attached screenshots. With a comment returns 5 rows, without the (correct) 500K+ rows. What am I missing here?

alt text

0 Karma

woodcock
Esteemed Legend

You could figure this out if you tapped SHIFT-CTRL-E for Expand Macro and you would see that this reduced down to:

(index=* search)

which is incorrect. If you get rid of the search, it works as you would expect.

0 Karma

bretlowery1
New Member

alt text

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...