Splunk Search

what are the possibilities of getting different results for same search

raghu0463
Explorer

what are the possibilities of getting different results for same search ( there is no change in query and time) ?

Tags (1)
0 Karma

MuS
Legend

Hi raghu0463,

User permissions, app context, search modes (Fast vs Smart vs Verbose), knowledge objects permission, roles, even you mentioned it - but make really sure you are searching over the exact same time range (use a fixed range over yesterday for example), don't run real-time searches and compare results, late arriving events, time not in sync in your environment, wrong timestamp recognition ... the list is really long and did I mention time zones?

Hope this helps in some way ...

cheers, MuS

somesoni2
Revered Legend

There may be different count if new data is coming in with timestamp within the time range you selected. If you're using relative time (like last 1 hour or last 24 hours), the time range is actually changing (see the timestamp in result summary just below the search bar on left) so you may get different count. Also, if there are some indexing delay involved you may be getting few events become searchable when you run the search next time.

Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...