Splunk Search

Output Lookup command sending less results

architkhanna
Path Finder

I have a output lookup command which returns 4 rows via saved search when ran independently.

However,on running the input lookup command, I see only 3 rows and hence my panels are populating wrong.
Any limitations are there in the command. I am not sure where is this going wrong.
TIA.

0 Karma

koshyk
Super Champion

outputlookup should put same results as the outcome of the events.
Please check
- if your time range is exactly(precisely) the same when you tested and when the savedsearch ran
- Check if the savedsearch ran again on top and saved another result than your expected time range

Please give us the actual dataset and savedsearches query to debug more

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...