Hi Splunkers! The issue I am having is regarding different results from alerts when some condition is met, compared to manual search results on the same query and time frame. I am having a repeated i...
See more...
Hi Splunkers! The issue I am having is regarding different results from alerts when some condition is met, compared to manual search results on the same query and time frame. I am having a repeated issue between different search queries including different functions, where an alert is triggered, and when i view the results of the alert, it outputs for example 3000 events scanned, and 2 results in the statistic section. While when i manually trigger this search it will output 3500 events scanned and 0 results in the statistic scan. I cant find any solution online, and this issue is causing several of my alerts to false alert. here is an example query that is giving me this issue incase that is helpful:
index="index" <search> earliest=-8h@h
|stats count(Field) as Counter earliest(Field) as DataOld by FieldA, Field B
|where DataNew!=DataOld OR isnull(DataOld)
|table Counter, DataOld, Field A, Field B
any help is very appericated!