https://community.splunk.com/t5/Dashboards-Visualizations/How-to-search-on-nested-fields-not-returning-the-right-results/m-p/642081#M52446 <P>Are the JSON fields being auto extracted in all cases and what is the length of the JSON data? Best thing to diagnose is to focus on a single event that you can see has errorCode=9001, but is not found in the search and understand why that event is not found.</P><P>If can be that the field does not exist (i.e. it is not a Splunk field, as opposed to it not existing in the data) prior to the search.</P><P>When you have a single search result that does not work, look at the extracted field table on the left and see what fields Splunk thinks it has.</P><P>&nbsp;</P> Wed, 03 May 2023 00:43:23 GMT bowesmana 2023-05-03T00:43:23Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-search-on-nested-fields-not-returning-the-right-results/m-p/641891#M52421 <P>The search which is fetching based on one of the nested fields "labels.errorCode" does not return the same results,<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="query returning the wrong number of results" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/25154iE83B76830E1EAA1E/image-size/large?v=v2&amp;px=999" role="button" title="query-returning-incorrect-results.png" alt="query returning the wrong number of results" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">query returning the wrong number of results</span></span></P> <P>This search below returns the right results. But we would like to search based on the field labels.errorCode.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="query returning the right number of results" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/25155i49628745DE0AFCA3/image-size/large?v=v2&amp;px=999" role="button" title="query-returning-right-results.png" alt="query returning the right number of results" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">query returning the right number of results</span></span></P> Mon, 01 May 2023 14:52:57 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-search-on-nested-fields-not-returning-the-right-results/m-p/641891#M52421 rxvichi 2023-05-01T14:52:57Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-search-on-nested-fields-not-returning-the-right-results/m-p/641942#M52428 <P>Your searches are different - one searches labels.errrorCode=9001 and the other searches with other search strings. Why is 29 results in your first search "wrong" - what is wrong?</P><P>Is it returning 29 results that do NOT have labels.errorCode=9001 - you have redacted the data in that, so I can't know</P><P>Is 154,465 results the correct number of results which contain labels.errorCode=9001?</P><P>&nbsp;</P> Tue, 02 May 2023 04:11:16 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-search-on-nested-fields-not-returning-the-right-results/m-p/641942#M52428 bowesmana 2023-05-02T04:11:16Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-search-on-nested-fields-not-returning-the-right-results/m-p/642007#M52432 <P>Sorry I made it a bit confusing. The first search result does not return the values returned in the second search result even though the second search result has labels.errorCode=9001. The first search does not return all the values it just returns a subset. Also the redacted data is the same in both queries.</P> Tue, 02 May 2023 14:19:03 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-search-on-nested-fields-not-returning-the-right-results/m-p/642007#M52432 rxvichi 2023-05-02T14:19:03Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-search-on-nested-fields-not-returning-the-right-results/m-p/642081#M52446 <P>Are the JSON fields being auto extracted in all cases and what is the length of the JSON data? Best thing to diagnose is to focus on a single event that you can see has errorCode=9001, but is not found in the search and understand why that event is not found.</P><P>If can be that the field does not exist (i.e. it is not a Splunk field, as opposed to it not existing in the data) prior to the search.</P><P>When you have a single search result that does not work, look at the extracted field table on the left and see what fields Splunk thinks it has.</P><P>&nbsp;</P> Wed, 03 May 2023 00:43:23 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-search-on-nested-fields-not-returning-the-right-results/m-p/642081#M52446 bowesmana 2023-05-03T00:43:23Z