Splunk query not producing expected result

ravimishrabglr — Mon, 25 Oct 2021 11:56:58 GMT

Below query is producing expected result only sometime, but not working for similar data on some other random days.

Query:

index=my_summary source=app_response_status report=app_response_status ApiName=metadata
| timechart span=1d sum("200"), sum("404")

Working Data:

10/24/2021 00:00:00 +0000, search_name=app_response_status, search_now=1635123600.000, info_min_time=1635033600.000, info_max_time=1635120000.000, info_search_time=1635124485.280, 200=7552, 404=7582, ApiName=metadata, info_sid=scheduler__gmrm_VkEtdm1lLXJ0bXMtc2g__RMD50cd89fe00e4c64f8_at_1635123600_39072, RowTotals=15134, info_max_time="1635120000.000", info_min_time="1635033600.000", info_search_time="1635124485.280", report=app_response_status

Not Working Data:

09/03/2021 00:00:00 +0000, search_name=app_response_status, search_now=1630717200.000, info_min_time=1630627200.000, info_max_time=1630713600.000, info_search_time=1630717575.202, 200=9483, 404=5287, ApiName=metadata, info_sid=scheduler__gmrm_VkEtdm1lLXJ0bXMtc2g__RMD50cd89fe00e4c64f8_at_1630717200_72746, RowTotals=14770, info_max_time="1630713600.000", info_min_time="1630627200.000", info_search_time="1630717575.202", report=app_response_status

I am not able to figure out the problem, both data looks same to me, but not sure why it is not working. pls help.

Re: Splunk query not producing expected result

PickleRick — Mon, 25 Oct 2021 13:04:09 GMT

Probably depends on what parsing rules you have for this sourcetype. Try to search for the first event and do

| table *

on it. Then do the same with the other one.

I'm not sure if you're not having some extra spaces before/after commas in one of the events but I can't tell if this breaks your parsing.

topic Splunk query not producing expected result in Splunk Enterprise

Splunk query not producing expected result

Re: Splunk query not producing expected result