Reporting

Why am I getting two different sets of data from the same report?

a212830
Champion

Hi,

I took a search that runs on the license manager, and moved it over to our search-heads, so that customers can have reports/dashboards available to them. On the license manager, it looks correct - showing 7 days of data. The license manager forwards it's data to our indexes (and it has for some time). We recently added a new license pool, and I'm adding some reports for this customer. On the license manager, I get 7 days worth of data, but on the search-head, it only shows 2 days. I have no idea why. My search is listed below. I also tried it without the "set_local_host" macro.

index=_internal [`set_local_host`] source=*license_usage.log* type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx  | search pool="PWI License" | timechart span=1d sum(b) AS volumeB by st fixedrange=false  | join type=outer _time [search index=_internal [`set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d  | search pool="PWI License" | eval _time=_time - 43200 | bin _time span=1d | stats latest(poolsz) AS  "pool size" by _time] | fields - _timediff  | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]
0 Karma

sbbadri
Motivator

index=_internal source=license_usage.log type="Usage" earliest=-7d@d latest=now | rest of the query.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Sounds like the Search Head may not be searching across the same data set (indexers). I would check this two ways:

  1. Run the search on both systems and look at the indexers called by the Job Inspector. Are the same dispatch.stream.remote.<indexername> listed?
  2. Check the permissions on the indexers. Does indexer for some reason have different permissions than the search heads? Does the user's role limit searches to two days perchance?
  3. Check the Search Peers on the different instances. Assuming it's a search head of the indexer cluster, does the SH traverse and return data (Job Inspector) from the same set of indexers?
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...