how can test my search query to make sure splunk is giving correct output

[anandbharti]

I want to test the data retrieved by Splunk query. How can I validate the results.

[wildcats12]

If you don't have a good set of test data to search through, you could always create your own. Either upload a lookup table with some test events or use:
| makeresults

Makeresults will create and empty line and you can use evals to put in any data you like. Just drop that in front of your search and see if it produces the expected results. You can use multiple test lines this way by appending extra makeresults if needed:
| append [| makeresults]

[somesoni2]

YOu want to validate the query you write is correct OR Splunk is showing correct/all data you expect? Either way, you'll check the data in Splunk via query, with whatever logic/aggregation you want to do, then do the same manually on the raw data Or data at source (from where Splunk is reading it) and compare the results.