Splunk Search

Why in my current search, fewer results appear?

splunkcol
Contributor

Hello everyone,
A query, I have the following problem where a query is made to a specific index and sourcetype at a certain time and if the next day I execute that query again, the number of events is less. It is worth mentioning that it is not possible to see any corrupted buket, or that the space of the indexers is full, which could cause a loss of information.

Excuse the translation by google

Labels (1)
Tags (1)
0 Karma

PickleRick
Ultra Champion

Hard to say without actually seeing your search. The most obvious possible reason that comes to mind is that you indeed have fewer and fewer events in the specified timerange. Maybe some buckets expire. Maybe the inputs stopped working...

See the report in job inspector.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...