topic Re: Splunk Query provided wrong results in Splunk Search

Splunk Query provided wrong results

Gowtham0809 — Mon, 24 Feb 2020 08:06:59 GMT

Hello,

Splunk query provided in correct responses. I have A query which filters the data on a specific day and provided the results. Here we index the CSV data every day by using CRCSALT= as we need the whole data set to be reindex even if there is no change in data set.

in the Query I have used a Eval command to print a value CAP-M1 , M2, M3 etc for each query outcome as a unique identifier. but by query provided corrects unique values while executing. for Example I have a Query A with unique value CAP-M1 and Query B suppose to print unique value as CAP-M2 but in the query B it keeps providing Value M1 instead of M2.

in the screen shot it suppose to print M4 for all days but its printing various values

Similarly for other searched also. Is this due to some cache memory issue in splunk?

Thanks

Re: Splunk Query provided wrong results

to4kawa — Mon, 24 Feb 2020 08:43:55 GMT

No, your search results are exactly as you searched

Re: Splunk Query provided wrong results

Gowtham0809 — Mon, 24 Feb 2020 08:47:44 GMT

There is no eval command for CAP-M1 or M11 or M7 is defined in the query, It was only M4 defined in the Query. I also get this error "Could not find object id=CAP-M4 " sometimes

The results should me CAp-M4 for all 4 rows.

Re: Splunk Query provided wrong results

to4kawa — Mon, 24 Feb 2020 08:54:21 GMT

Maybe your huge query is work.
but SPL is simple.
so, I say again. your search results are exactly as you searched

If you don't provide the query, nobody resolve your issue.

Re: Splunk Query provided wrong results

to4kawa — Wed, 30 Sep 2020 04:20:47 GMT

|eval Metric_ID="CAP-M4"
|eval ProjectCluster_Name="VRTE Platform"
|join type=inner DNGProjectAreaID max=0 [search index="usa_201920_test" |eval Date=strftime(_time,"%Y-%m-%d")|dedup Date ]

This join will update Metric_ID.
By the way, there are many join.

Re: Splunk Query provided wrong results

Gowtham0809 — Tue, 25 Feb 2020 06:45:58 GMT

Thanks for your input,but the same join prints the Value CAP-M1 instead of CAP-M4, irrespective of what eval values been provided, result is CAP-M1, I guess something in spunk memory which is printing CAP-M1 by default in all queries.

Weirdly even without Eval command query results prints CAP-M1.

Re: Splunk Query provided wrong results

to4kawa — Tue, 25 Feb 2020 19:29:19 GMT

index="usa_201920_test" source=`Source_DNG_ProjectArea`
OR (source=`Source_DNG_RequirementModules` ModuleType="*" )
OR source=`Source_Sys_Validation`
OR source=`Source_RQM_Testcase` 
OR source=`Source_RQM_TestExecution`
OR (source=`Source_RQM_TestcaseResults` Verdict="" OR Verdict!="passed")
OR (source=`Source_DNG_SystemRequirements` SysReqType="System Requirement" )

To be honest, I think it would be faster and more appropriate to focus on source from this results.