Splunk Search

Output Lookup command sending less results

architkhanna
Path Finder

I have a output lookup command which returns 4 rows via saved search when ran independently.

However,on running the input lookup command, I see only 3 rows and hence my panels are populating wrong.
Any limitations are there in the command. I am not sure where is this going wrong.
TIA.

0 Karma

koshyk
Super Champion

outputlookup should put same results as the outcome of the events.
Please check
- if your time range is exactly(precisely) the same when you tested and when the savedsearch ran
- Check if the savedsearch ran again on top and saved another result than your expected time range

Please give us the actual dataset and savedsearches query to debug more

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...