Splunk Search

Why is performance worse in Splunk 6.2.1 and the results are different between dashboard chart count and actual search query count?

asifhj
Path Finder

Hi Splunkers,

I am using Splunk 6.2.1 and I found a very disappointing match between chart count and actual search query count.

Queries in chart(42 Single value) and search box is exactly same.

Search query results are accurate but not the chart count in dashboard.

Used query is

... | search Call=C OR Call=U | search datetoday=Match | stats count

and lastly, the performance is worse as compared to previous versions. It's lagging.

Any help would be appreciated.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What is your full query? It seems that you may be able to merge all the filter conditions in one go and that should improve the performance.
Also, did you see what events are getting missed to cause the count difference?

0 Karma

tachifelix
Path Finder

last version of splunk have is unreliable Version.
me too i try some query with join and follows with appendcols command in 6.2.1. i have different result for 6.1.2 (correct one)

0 Karma

asifhj
Path Finder

Tried 6.1.2, no luck

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...