Why isn't my search showing the full results?

[splunker969]

When I search for this query it shows wrong results ?

|metadata type=hosts index=* |lookup domain.csv host output domain datacenter host IP |search domain=Y|eval age=(now()-recentTime)|convert ctime(*Time)| append[ |inputlookup domain.csv ] | dedup host | fields host IP domain datacenter lastTime age totalCount| sort lastTime

When I serach for this query shows full results ?

host=wdc |stats count by host

Any help .

[DalJeanis · Accepted solution]

According to this answer by @somesoni2, metadata is not time bound.

As such, it is never going to match exactly with numbers you get from the other search.

Here's a quote from the metadata documentation

In small testing environments, the data is complete. However, in environments with large numbers of values for each category, the data might not be complete. This is intentional and allows the metadata command to operate within reasonable time and memory usage.

[splunker969]

Thanks @ DalJeanis

[lfedak_splunk]

Hey @splunker969, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂

[splunker969]

sure , .@ ifedak ,the problem was not resolved .Thanks 🙂

[sbbadri]

try this
metadata type=hosts index=* |lookup domain.csv host OUTPUTNEW domain datacenter host IP |eval test=if(domain=="Y", "Logging In", "Not Logging In") |eval age=(now()-recentTime)|convert ctime(*Time)| append[ |inputlookup domain.csv ] | dedup host | fields host IP domain datacenter lastTime age test
totalCount| sort lastTime

[splunker969]

@sbbadri No ,results after searching above query ,Thanks @sbbadri

[gcusello]

Hi splunker969
did you tried

| metasearch index=* 
| lookup domain.csv host OUTPUT domain datacenter host IP 
| search domain=Y 
| eval age=(now()-recentTime) 
| convert ctime(*Time) 
| append [ |inputlookup domain.csv ] 
| dedup host 
| fields host IP domain datacenter lastTime age totalCount
| sort lastTime

?
Anyway in your search there is something strange: you append a lookup rows (without date/time field) to a search with date/time and then you perform a dedup by host (deleting in this way some results maybe with time and age) and then you sort results by lastTime that it isn't in the lookup, what do you want as result?

Bye.
Giuseppe

[splunker969]

Actually we are trying to right above search with logging list and not logging list to be in same list .So we used that above search.

[splunker969]

Thanks @ cusello

[DalJeanis]

When you coded this...

| lookup domain.csv host output domain datacenter host IP 

I suspect you may have meant this...

| lookup domain.csv host OUTPUT domain datacenter host IP 

[splunker969]

I dont see any change after changing Capital OUTPUT .

[splunker969]

Iam not sure why the metadata search is not showing full results .