Troubleshoot search results

You might get unexpected search results if you inadvertently use index time as the Time Tange in your correlation search.

Cause

Solution

Unexpected search results from the correlation search

Follow these steps to check whether the search is using index time: Check the savedsearches.conf configuration file to see if the search is using indextime since configuration file settings often change. Check the fields in the notable event and risk event. If any of the following three fields exist, it indicates that the time range setting was index time when the correlation search was run. use_indextime; info_min_indextime; info_max_indextime Custom searches might also inadvertently use index time. Check the SPL of the custom search to verify the Time Range used. Check the scheduler log and the search execution audit logs to see if index time is used in the saved search or drill-down search. Sometimes, if the parent correlation search is using Index time, the underlying drill-down search might also use index time.