Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Splunk dashboard base search gives result which is different from that of an identical non-base search

$
0
0
I am using Splunk Enterprise 6.6.2, and today I noticed an alarming problem. In order for me to troubleshoot the problem, I created a bare-bone version of my dashboard:
index=summary_price source=summary-price-quotation-view | fields count$time.earliest$$time.latest$
-1d@d@d
Normal Searchindex=summary_price source=summary-price-quotation-view | stats sum(count) as count$time.earliest$$time.latest$
Uses Base Search| stats sum(count) as count
The first table doesn't use the base search, while the second table uses the base search. Both searches are identical at the end. However, they gives different result (2,526,053 vs. 2,086,762), as shown in the attached image, and the difference is huge! ---------- ![alt text][1] ---------- I also looked at the Jobs page, and from that the two searches look similar (although the sizes are different): ---------- ![alt text][2] ---------- What can explain the difference? Is it a bug in Splunk? [1]: /storage/temp/225635-screen-shot-2018-01-03-at-60714-pm.png [2]: /storage/temp/225636-screen-shot-2018-01-03-at-61416-pm.png

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>