Splunk Search

.csv file does not contain all data

JYTTEJ
Communicator

I have set up a scheduled report which select current month data.

I have set up the report to be sent as a .csv file to a number of e-mail adresses. The same report is also included in a DashBoard as a table.

In the start of the month the number of data is same in the .csv file and in the DashBoard

But in the middle of the month the .csv file does not contain ALL data - whereas the report shown in the DashBoard do contain all data.

Has somebody else experienced this? - and do you have an explanation - and hopefully a solution?

The setup is as follows:

Schedule type= Basic

Run every day at midnight

Perform actions: always

Alert actions: Send E-mail

Include results in e-mail

Tags (1)
0 Karma

hazekamp
Builder

There could be a number of reasons why a report generated by the "scheduler" (alerts) vs. a dashboard, but the most common are related to permissions and timestamping. If timestamps (_time) in your data are being extracted incorrectly, or with great enough drift you could see discrepencies between scheduled and dashboard based searches.

Without having some specifics around your configurations this is a bit tricky to answer. There is also some weirdness related to why this works part of the month, but not in the middle.... I would recommend opening a case with support if this is still an issue for you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...