https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676050#M11348 <P>Thank you! It is working</P> Wed, 31 Jan 2024 11:58:30 GMT krishna1 2024-01-31T11:58:30Z https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676038#M11343 <P>Iam getting different results for same query when checked in statistics and visualizations, Attaching both screenshots<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="krishna1_0-1706696012959.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29142iE6E841F790C594B3/image-size/large?v=v2&amp;px=999" role="button" title="krishna1_0-1706696012959.png" alt="krishna1_0-1706696012959.png" /></span></P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="krishna1_1-1706696220064.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29143iE3B84AE731DD0A6D/image-size/large?v=v2&amp;px=999" role="button" title="krishna1_1-1706696220064.png" alt="krishna1_1-1706696220064.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 31 Jan 2024 10:18:04 GMT https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676038#M11343 krishna1 2024-01-31T10:18:04Z https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676039#M11344 <P>What do you mean by "different results"? They seem pretty much consistent.</P> Wed, 31 Jan 2024 10:24:52 GMT https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676039#M11344 PickleRick 2024-01-31T10:24:52Z https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676040#M11345 <P>The data in the chart is consistent with the data in the table - the issue is that the chart is treating _time as a special case of field - you can get around this by creating a new field called time and removing _time - you would need to ensure that the time field is listed first so that it becomes the x-axis</P><LI-CODE lang="markup">| gentimes start=-365 | rename starttime as _time | fields _time | eval location=mvindex(split("ABCDEFGH",""),random()%8) ``` the lines above generate random data for testing ``` | timechart span=1mon count by location | tail 6 | eval time=strftime(_time,"%Y-%m") | fields - _time | table time *</LI-CODE> Wed, 31 Jan 2024 10:52:35 GMT https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676040#M11345 ITWhisperer 2024-01-31T10:52:35Z https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676042#M11346 <P>in table , _time is converted into month buckets but in chart, in X-axis its not getting showing monthly buckets</P><P>&nbsp;</P> Wed, 31 Jan 2024 10:56:49 GMT https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676042#M11346 krishna1 2024-01-31T10:56:49Z https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676043#M11347 <P>That's simply how Splunk shows the _time field. The data is consistent, the presentation might indeed be a bit confusing. You can get&nbsp; around it as <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a> showed already.</P> Wed, 31 Jan 2024 10:58:44 GMT https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676043#M11347 PickleRick 2024-01-31T10:58:44Z https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676050#M11348 <P>Thank you! It is working</P> Wed, 31 Jan 2024 11:58:30 GMT https://community.splunk.com/t5/Splunk-Dev/Iam-getting-different-outputs-for-same-query/m-p/676050#M11348 krishna1 2024-01-31T11:58:30Z