https://community.splunk.com/t5/Getting-Data-In/Appendcols-Issue-in-the-output-of-the-query/m-p/545295#M90924 <P>Is your subsearch getting truncated due to limits on subsearches?</P> Thu, 25 Mar 2021 08:57:47 GMT ITWhisperer 2021-03-25T08:57:47Z https://community.splunk.com/t5/Getting-Data-In/Appendcols-Issue-in-the-output-of-the-query/m-p/545287#M90923 <P>Query1 : index="*" earliest=-1mon@mon latest=@mon<BR />| stats count</P><P>O/P : 25,419,925,723</P><P>Query2 : index="*" earliest=-2mon@mon latest=-1mon@mon<BR />| stats count as Twomonthsbeforecount<BR />| appendcols<BR />[ search index="*" earliest=-1mon@mon latest=@mon<BR />| stats count as Onemonthbeforecount ]<BR />| eval Difference=Onemonthbeforecount-Twomonthsbeforecount<BR />| table Difference Onemonthbeforecount Twomonthsbeforecount</P><P>O/P :</P><TABLE width="396"><TBODY><TR><TD width="91">Difference</TD><TD width="149">Onemonthbeforecount</TD><TD width="156">Twomonthsbeforecount</TD></TR><TR><TD width="91">-26541517755</TD><TD>169524875</TD><TD>26711042630</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Query 1 output should match the Query 2 "Onemonthbeforecount " column value, but why is it differing? Am i missing out something to check?</P> Thu, 25 Mar 2021 07:43:51 GMT https://community.splunk.com/t5/Getting-Data-In/Appendcols-Issue-in-the-output-of-the-query/m-p/545287#M90923 vn_g 2021-03-25T07:43:51Z https://community.splunk.com/t5/Getting-Data-In/Appendcols-Issue-in-the-output-of-the-query/m-p/545295#M90924 <P>Is your subsearch getting truncated due to limits on subsearches?</P> Thu, 25 Mar 2021 08:57:47 GMT https://community.splunk.com/t5/Getting-Data-In/Appendcols-Issue-in-the-output-of-the-query/m-p/545295#M90924 ITWhisperer 2021-03-25T08:57:47Z https://community.splunk.com/t5/Getting-Data-In/Appendcols-Issue-in-the-output-of-the-query/m-p/545296#M90925 <P>No I don’t see any DAG execution error&nbsp;</P> Thu, 25 Mar 2021 09:04:12 GMT https://community.splunk.com/t5/Getting-Data-In/Appendcols-Issue-in-the-output-of-the-query/m-p/545296#M90925 vn_g 2021-03-25T09:04:12Z https://community.splunk.com/t5/Getting-Data-In/Appendcols-Issue-in-the-output-of-the-query/m-p/545329#M90927 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/40398">@vn_g</a>,</P><P>Can you try with tstats?</P><LI-CODE lang="markup">| tstats count as Twomonthsbeforecount where index="*" earliest=-2mon@mon latest=-1mon@mon | appendcols [ tstats count as Onemonthbeforecount where index="*" earliest=-1mon@mon latest=@mon ] | eval Difference=Onemonthbeforecount-Twomonthsbeforecount | table Difference Onemonthbeforecount Twomonthsbeforecount</LI-CODE> Thu, 25 Mar 2021 10:37:08 GMT https://community.splunk.com/t5/Getting-Data-In/Appendcols-Issue-in-the-output-of-the-query/m-p/545329#M90927 scelikok 2021-03-25T10:37:08Z https://community.splunk.com/t5/Getting-Data-In/Appendcols-Issue-in-the-output-of-the-query/m-p/545346#M90932 <P>Yes, this helped. Thankyou so much</P> Thu, 25 Mar 2021 11:03:16 GMT https://community.splunk.com/t5/Getting-Data-In/Appendcols-Issue-in-the-output-of-the-query/m-p/545346#M90932 vn_g 2021-03-25T11:03:16Z