Splunk Search

The same sql but different searche result

kavana
Explorer

The SPL below was ran in search bar and table in panel, but the search result are different.

Why the same SPL made different result?


source="after.csv" host="CDC311241" index="fuji_xerox_zhuwenbin" sourcetype="csv" "商談コード"=1410001001

|rename "ステータス" as status |dedup status

|eval process=if(status=="XXMB_ACTIVE","OK","NG")

|stats count(eval(process="OK")) AS OK,count(eval(process="NG")) AS NG BY "商談コード"

|eval porcessmid = if(OK>0 AND NG=0,"OK","NG")|table porcessmid

|append[search source="onetime.csv" host="CDC311241" index="fuji_xerox_zhuwenbin" sourcetype="csv" "商談コード"=1410001001

|rename "注文日" as chumonbi

|eval porcessmid = if(isnull(chumonbi),"NG","OK")

|table porcessmid]

|stats count(eval(porcessmid="OK")) AS OK,count(eval(porcessmid="NG")) AS NG

|eval processend = if(NG>0,"NG",if(OK>0,"OK","NG"))
|table processend

        |rename "契約連番" as aftercontractno,"取引番号" as torihikino|eval version =2  
        |JOIN type=inner aftercontractno version[search source="after.csv" host="CDC311241" index="fuji_xerox_zhuwenbin" sourcetype="csv" "商談コード"=1410001001  
        |rename "個別契約連番" as aftercontractno|eval version=2] |eval MB=substr(torihikino,0,2)     
        |eval process = if(MB=="MB","OK","NG") |appendpipe [stats count | eval process = "OK" | eval somecolumn = 0 | where count==0] |table process    
        |append[search source="seikyuzumi_code.csv" host="CDC311241" index="1012test" sourcetype="csv"  
        |rename "契約連番" as aftercontractno,"発行F" as excuteflag   
        |JOIN type=inner aftercontractno [search source="after.csv" host="CDC311241" index="fuji_xerox_zhuwenbin" sourcetype="csv" "商談コード"=1410001001     
        |rename "個別契約連番" as aftercontractno|eval version=2  
        |JOIN type=inner aftercontractno version[search source="afterrireki.csv" host="CDC311241" index="1012test" sourcetype="csv"     
        |rename rireki as version,"個別契約連番" as aftercontractno]]     
        |eval process = if(excuteflag=="1","OK","NG") |appendpipe [stats count  
        | eval process = "NG" |eval somecolumn = 0 | where count==0] |table process]    
        |stats count(eval(process="OK")) AS OK,count(eval(process="NG")) AS NG  
        |eval processend = if(NG>0,"NG",if(OK>0,"OK","NG")) |table processend]  
        |stats count(eval(processend="OK")) AS OK,count(eval(processend="NG")) AS NG    
        |eval processendTWO = if(NG>0,"NG",if(OK>0, "OK","NG"))     
        |table processendTWO |eval severity=case(processendTWO="OK", 5, processendTWO="NG", 50)     
        |rangemap field=severity low=1-30 elevated=31-39 default=severe 

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You might need to give little more details like what are the differences in result etc.

Most probably, it has something to do with field extraction due to search mode. You might be executing the search in search bar with verbose mode where as in dashboard panel, it's smart mode by default.

You can verify this by opening the search result in search bar from table and see the difference

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...