Splunk Search

Why is Appending two search queries with different conditions giving me the same results?

monyathomas
New Member

I have two survey types "a" and "b" and there are two details need to be displayed as 'a%' (For all kind of "Data") and 'a1%" (For "Data"="N/A" OR "Data"="Yes" ) .However when I am using append and trying the below query , I see that both the columns a% and a1% are displaying the same results.

index="xyz"
| fillnull "Data" value="N/A"
|chart count over "Survey Month" by "Survey Type"
| addtotals
|rename Total as "Grand Total"
| eval "a%"=round(('a'/'Grand Total')*100,2)
| eval "a%"='a%'+"%"
| table "Survey Month","a","b","a%"
|append[search "Data"="N/A" OR "Data"="Yes"
| chart count over "Survey Month" by "Survey Type"]|addtotals
| rename Total as "Grand Total"
| eval "a1%"=round(('a'/'Grand Total')*100,2)
| eval "a1%"='a1%'+"%"
| table "Survey Month","a%","a1%"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are the two queries really different? They look different, but perhaps index "xyz" only contains events with the Data field of "N/A or "Yes". And maybe events with the Data field of "N/A or "Yes" only exist in index "xyz". Base searches should be as specific as possible without eliminating desired events.

---
If this reply helps you, Karma would be appreciated.
0 Karma

monyathomas
New Member

Yes, the queries are different. And, the Data field consists - "N/A","Yes","No" and "Exception Scenario" and all of them exist in the index "xyz" . However,while using the above search query I am not able to retrieve the data as per my expectation.Kindly suggest a way forward.

0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...