https://community.splunk.com/t5/Splunk-Search/Why-is-Appending-two-search-queries-with-different-conditions/m-p/425813#M122052 <P>Yes, the queries are different. And, the Data field consists - "N/A","Yes","No" and "Exception Scenario" and all of them exist in the index "xyz" . However,while using the above search query I am not able to retrieve the data as per my expectation.Kindly suggest a way forward.</P> Mon, 17 Jun 2019 04:14:03 GMT monyathomas 2019-06-17T04:14:03Z https://community.splunk.com/t5/Splunk-Search/Why-is-Appending-two-search-queries-with-different-conditions/m-p/425811#M122050 <P>I have two survey types "a" and "b" and there are two details need to be displayed as 'a%' (For all kind of "Data") and 'a1%" (For "Data"="N/A" OR "Data"="Yes" ) .However when I am using append and trying the below query , I see that both the columns a% and a1% are displaying the same results.</P> <P>index="xyz"<BR /> | fillnull "Data" value="N/A"<BR /> |chart count over "Survey Month" by "Survey Type" <BR /> | addtotals <BR /> |rename Total as "Grand Total"<BR /> | eval "a%"=round(('a'/'Grand Total')*100,2) <BR /> | eval "a%"='a%'+"%" <BR /> | table "Survey Month","a","b","a%" <BR /> |append[search "Data"="N/A" OR "Data"="Yes" <BR /> | chart count over "Survey Month" by "Survey Type"]|addtotals<BR /> | rename Total as "Grand Total"<BR /> | eval "a1%"=round(('a'/'Grand Total')*100,2)<BR /> | eval "a1%"='a1%'+"%"<BR /> | table "Survey Month","a%","a1%"</P> Wed, 30 Sep 2020 00:55:54 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-Appending-two-search-queries-with-different-conditions/m-p/425811#M122050 monyathomas 2020-09-30T00:55:54Z https://community.splunk.com/t5/Splunk-Search/Why-is-Appending-two-search-queries-with-different-conditions/m-p/425812#M122051 <P>Are the two queries really different? They look different, but perhaps index "xyz" only contains events with the Data field of "N/A or "Yes". And maybe events with the Data field of "N/A or "Yes" only exist in index "xyz". Base searches should be as specific as possible without eliminating desired events.</P> Fri, 14 Jun 2019 12:25:38 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-Appending-two-search-queries-with-different-conditions/m-p/425812#M122051 richgalloway 2019-06-14T12:25:38Z https://community.splunk.com/t5/Splunk-Search/Why-is-Appending-two-search-queries-with-different-conditions/m-p/425813#M122052 <P>Yes, the queries are different. And, the Data field consists - "N/A","Yes","No" and "Exception Scenario" and all of them exist in the index "xyz" . However,while using the above search query I am not able to retrieve the data as per my expectation.Kindly suggest a way forward.</P> Mon, 17 Jun 2019 04:14:03 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-Appending-two-search-queries-with-different-conditions/m-p/425813#M122052 monyathomas 2019-06-17T04:14:03Z