I am using Splunk Enterprise 6.6.2, and today I noticed an alarming problem.
In order for me to troubleshoot the problem, I created a bare-bone version of my dashboard:
The first table doesn't use the base search, while the second table uses the base search. Both searches are identical at the end. However, they gives different result (2,526,053 vs. 2,086,762), as shown in the attached image, and the difference is huge!
----------
![alt text][1]
----------
I also looked at the Jobs page, and from that the two searches look similar (although the sizes are different):
----------
![alt text][2]
----------
What can explain the difference? Is it a bug in Splunk?
[1]: /storage/temp/225635-screen-shot-2018-01-03-at-60714-pm.png
[2]: /storage/temp/225636-screen-shot-2018-01-03-at-61416-pm.png
↧