I am populating the data in summary index using the following Splunk search
index=data" | sistats count as total by appName,trueclient, httpstatus,request_uri
when, I do stats over this
index=summary_ |stats count as total by appName.
We are getting lot of difference in counts.
When, I run the search directly the app counts are very low, then on summary index it's very high. Why summary index data is returning wrong data? is it because, I added trueclient, httpstatus,request_uri in sistats?
When you search for just
How many different source values are you getting? Are you getting sources outside of the search you used to populate it? If so, limit down to just the name of the search as your source when you search and see if the numbers look better.
When you use the
si* command for summary index, you need to use the same aggregation command on the summary index data. Give this a try and see if the counts are matching.
index=summary | stats count as total by appName,trueclient, httpstatus,request_uri | stats sum(total) as total by appName
compare with this.
index=data |stats count as total by appName
I have exactly the same problem. Multiple entries in the summary index for the same data. Only one value for info_search_time So it looks like it is one search. only outputs on multiple indexers.
If i deleted the summary data and re runtje job to add the results to the summary index.I get double data only different as the previous summary data. So only a part of the data is double.