Same exact behavior, running 6.1.4 on Windows. I started out with these 2 queries and different events were returned.
these are the queries:
index= | lookup local=1 userstatus UserID as user_id OUTPUTNEW UserStatus as user_status | eval user_status = if(user_status="NONE", true, user_status) | search userstatus=true AND status = 200 AND (file=search OR file=content) | timechart count(method) by user_id
index= | lookup local=1 userstatus UserID as user_id OUTPUTNEW UserStatus as user_status | eval user_status = if(user_status="NONE", true, user_status) | search userstatus=true AND status = 200 AND (file=search OR file=content) | dedup user_id, date_month, date_mday | timechart count(user_id) As "User Count"
Then, I cut and pasted the 2nd query to the 1st window and received different results. (Same time frame for both queries).
,
... View more