Splunk Search

metadata command giving different answers on different search heads

dwaddle
SplunkTrust
SplunkTrust

I recently loaded a 4.2 search head onto my laptop in order to use it for testing some view development in a way that I wouldn't impact production users but could still use production event data. On my new search head, I've noticed the dashboard_live screen in the search app is off by several billion events compared to our production search head. Running this search on the two search heads:

| metadata type=sourcetypes

will give back different results. The one on my laptop excludes one of my sourcetypes with over 5 billion events. The one on the main search head/indexer (which is 64 bit btw) does not. Given my laptop is a 32-bit machine, is just just a case of the count is too big for a 32-bit integers or is something else afoot?

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

I think you got it right and the count returned by the metadata command is limited by your 32bit system to approximately 2 billion events.

If you want to perform further testing to confirm this, you could scope metadata to some individual indexes with the "index=" argument and compare those values. Try to get close to 2 billion events and see if that's the breaking point.

You can also try the following and see if it breaks 😄

* | head 1 | eval test=2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2+1 | eval result=if(test>2147483647,"win","lose!") | table test, result

Let us know, I'm curious but too lazy to find a 32 bit instance right now.

View solution in original post

hexx
Splunk Employee
Splunk Employee

I think you got it right and the count returned by the metadata command is limited by your 32bit system to approximately 2 billion events.

If you want to perform further testing to confirm this, you could scope metadata to some individual indexes with the "index=" argument and compare those values. Try to get close to 2 billion events and see if that's the breaking point.

You can also try the following and see if it breaks 😄

* | head 1 | eval test=2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2+1 | eval result=if(test>2147483647,"win","lose!") | table test, result

Let us know, I'm curious but too lazy to find a 32 bit instance right now.

dwaddle
SplunkTrust
SplunkTrust

Well, the eval works well above 32 bits. But, metadata limited to a specific index leaves out a sourcetype with > 4B events in it. This breakage may be specific to metadata... But it's not a big deal, it's just a test search head.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...