Splunk Search

Bug ? search result problem

tardieuxth
Engager

Hello,
We encounter a problem during search.

A search result differ from finding the results expected and not finding anything

the only change is the time period.

From 06:00:00 to 09:00:00 it's finding the result expected but between 06:13:00 to 09:10:00 nothing is find (see screenshots)

link text
link text

0 Karma

Matthias_BY
Communicator

Hi,

i just did had a second look at your screenshots. The first search does have time beginning at 6:13 am and the second search with results starts at 6:00 am. if i review the timeline with the bars of the successful search it can really be that all events have been in the timeframe between 6:00 - 6:13. 😉

alt text

alt text

tardieuxth
Engager

the searched was in course when I did the screenshot 🙂

by working to find out why my search wasn't working, we supposed that there is too much data to index and that it takes longer than expected to be treated.

I'll try in a few hours to see if we are true or not

0 Karma

Matthias_BY
Communicator

Hi Tardieu,

can you copy + paste or upload the info shown in the job inspector?
http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/ViewsearchjobpropertieswiththeJobInspect...

There we should find the cause.

br
Matthias

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...