https://community.splunk.com/t5/Splunk-Search/adding-lookup-in-query-ending-with-incorrect-result/m-p/570188#M198732 <P>i am getting two diffrent results in total. query1 is providing acurate result.&nbsp;</P><P>query2 as soom as adding |lookup locationdetails.csv City AS City total value to less than acurate one<BR />using splunk version 7.3.71<BR /><BR />query1<BR />index=xyz source=xyz&nbsp;<BR />|eval Month=strftime(_time,"%b %Y")<BR />|search&nbsp;Month="Mar 2021"<BR />|search Product In (Sold,Damaged)<BR />|stats count(Product) as Total&nbsp;</P><P><BR />query 2<BR />index=xyz source=xyz&nbsp;<BR />|eval Month=strftime(_time,"%b %Y")<BR />|search&nbsp;Month="Mar 2021"<BR />|search Product in (Sold,Damaged)<BR />|lookup locationdetails.csv City AS City<BR />|stats count(Product) as Total&nbsp;</P> Fri, 08 Oct 2021 09:33:39 GMT abdul 2021-10-08T09:33:39Z https://community.splunk.com/t5/Splunk-Search/adding-lookup-in-query-ending-with-incorrect-result/m-p/570188#M198732 <P>i am getting two diffrent results in total. query1 is providing acurate result.&nbsp;</P><P>query2 as soom as adding |lookup locationdetails.csv City AS City total value to less than acurate one<BR />using splunk version 7.3.71<BR /><BR />query1<BR />index=xyz source=xyz&nbsp;<BR />|eval Month=strftime(_time,"%b %Y")<BR />|search&nbsp;Month="Mar 2021"<BR />|search Product In (Sold,Damaged)<BR />|stats count(Product) as Total&nbsp;</P><P><BR />query 2<BR />index=xyz source=xyz&nbsp;<BR />|eval Month=strftime(_time,"%b %Y")<BR />|search&nbsp;Month="Mar 2021"<BR />|search Product in (Sold,Damaged)<BR />|lookup locationdetails.csv City AS City<BR />|stats count(Product) as Total&nbsp;</P> Fri, 08 Oct 2021 09:33:39 GMT https://community.splunk.com/t5/Splunk-Search/adding-lookup-in-query-ending-with-incorrect-result/m-p/570188#M198732 abdul 2021-10-08T09:33:39Z https://community.splunk.com/t5/Splunk-Search/adding-lookup-in-query-ending-with-incorrect-result/m-p/570233#M198746 <P>Seems strange indeed. Are you sure that your lookup doesn't overwrite Product field somehow? (you're not specifying output fields)</P> Fri, 08 Oct 2021 14:12:47 GMT https://community.splunk.com/t5/Splunk-Search/adding-lookup-in-query-ending-with-incorrect-result/m-p/570233#M198746 PickleRick 2021-10-08T14:12:47Z https://community.splunk.com/t5/Splunk-Search/adding-lookup-in-query-ending-with-incorrect-result/m-p/570404#M198816 <P>What are the fields in the lookup file?</P> Mon, 11 Oct 2021 00:24:50 GMT https://community.splunk.com/t5/Splunk-Search/adding-lookup-in-query-ending-with-incorrect-result/m-p/570404#M198816 bowesmana 2021-10-11T00:24:50Z