Difference in Queries

koushiknandan — Mon, 28 Sep 2020 18:06:52 GMT

Hi,

Though I'm receiving the same output for both my queries, curious to know the difference (executions, time taken, etc) between them.
The bold part is the only change.

index=PD host=ABC* uri="/XXXX" AND (http_status="200" OR http_status="500") | convert timeformat="%Y-%m-%d" ctime(_time) AS Date | stats count(eval(http_status="200")) as "HTTP 200", count(eval(http_status="500")) as "HTTP 500" by Date

index=PD host=ABC* uri="/XXXX" | convert timeformat="%Y-%m-%d" ctime(_time) AS Date | stats count(eval(http_status="200")) as "HTTP 200", count(eval(http_status="500")) as "HTTP 500" by Date

Thanks

Re: Difference in Queries

wpreston — Fri, 07 Nov 2014 13:52:02 GMT

Splunk gives the kind of information you're looking for in the job inspector. Take a look at it for each of your searches by clicking job --> inspect job and see if it has what you need.

topic Difference in Queries in Splunk Search

Difference in Queries

Re: Difference in Queries