Splunk Search

what are the possibilities of getting different results for same search

raghu0463
Explorer

what are the possibilities of getting different results for same search ( there is no change in query and time) ?

Tags (1)
0 Karma

MuS
Legend

Hi raghu0463,

User permissions, app context, search modes (Fast vs Smart vs Verbose), knowledge objects permission, roles, even you mentioned it - but make really sure you are searching over the exact same time range (use a fixed range over yesterday for example), don't run real-time searches and compare results, late arriving events, time not in sync in your environment, wrong timestamp recognition ... the list is really long and did I mention time zones?

Hope this helps in some way ...

cheers, MuS

somesoni2
Revered Legend

There may be different count if new data is coming in with timestamp within the time range you selected. If you're using relative time (like last 1 hour or last 24 hours), the time range is actually changing (see the timestamp in result summary just below the search bar on left) so you may get different count. Also, if there are some indexing delay involved you may be getting few events become searchable when you run the search next time.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...