Splunk Search

Why is the same search query used before & after the appendcols command producing different results in those 2 columns?

kelvin56887
Explorer

When I run "index=abc | table bytes | head 10", it returns:
bytes
1665
1369
2252
893
3920
356
1803
1718
2833
533

However, when I run:

index=abc | table bytes | head 10 | appendcols [search index=abc | table bytes | head 10 | rename bytes as ok ]

RESULTS TABLE:
bytes ok
1665 1665
1369 1369
2252 3825
893 2194
3920 2673
356 1659
1803 1808
1718 1206
2833 226
533 3973

Those 2 columns are expected to be the same but the results show that they are different.
Anyone know why?

0 Karma

jdbtee
Path Finder

try adding, to both queries:

| sort -$field | head...

As 'head', I think will just skim the first results it comes across, not sure why these would be different, but this forces splunk to follow the ordering.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...