Why is my search returning less results when it should return the same?

[carsonl]

Hi all,

Some background...
We have a large amount of data coming in, and the filename is used to derive some of the fields.

One of the fields is 'cclient', as we can see from the below search, it is extracting the field correctly:

index=bluecoat source=*Fox* earliest=-2w | stats count by cclient
    cclient count
    Fox_8   48412

However when searching, something strange happens... even though the data is there, it is returning substantially less than the previous query

index=bluecoat cclient=Fo* earliest=-2w | stats count by cclient
    cclient count
    Fox_8   1483

Even less when you go more specific...

index=bluecoat cclient=Fox* earliest=-2w | stats count by cclient
    cclient count
    Fox_8   1309

and even less again when you get even more specific...

index=bluecoat cclient=Fox_8 earliest=-2w | stats count by cclient
    cclient count
    Fox_8   27

Utilising quotes doesn't change anything. I have also cleared all eventdata from this index to ensure the change of data didn't do anything weird.

It is worth noting that when the string was "Fox 8", there wasn't this problem. I had to change the data to replace the space with an underscore, as tags cannot contain spaces... even when wrapped in quotes.

Has anyone seen this before? Is there a resolution/workaround?

I haven't updated to 4.3 yet...

Regards,

Carson.

[carsonl · Accepted solution]

It appears that upgrading to 4.3 fixed the issue. Makes me believe this was a Splunk bug.