topic Re: Search filter giving unexpected results in Splunk Search

Search filter giving unexpected results

szimmer661 — Tue, 29 Sep 2020 11:18:13 GMT

I have the following search:

index=ironstream MFSOURCETYPE=SMF110 (SAPPLID=CSFBTP0* AND (TRAN=PA6* OR HOL* OR SMX* OR SBI* OR SAP*)) | bin _time span=15m | eval IntervalTime=strftime(_time,"%H.%M") | chart count(TRAN) as "Transaction Count" over IntervalTime by TRAN

Results are including transaction names like LGAB, MBRC and SFBC and don't include transaction names like SMXS and SMXU, for which we did have counts for the time frame selected.

Results from a similar search with the same filters, but that sums a numeric field yield closer to expected results, but include a transaction named COIE and again don't include the SMX* transactions.

I obviously don't understand something about the filtering and any help will be greatly appreciated.

Re: Search filter giving unexpected results

sundareshr — Wed, 05 Oct 2016 19:00:49 GMT

Assuming the field TRAN has been extracted. try this

index=ironstream MFSOURCETYPE=SMF110 (SAPPLID=CSFBTP0* AND (TRAN=PA6* OR TRAN=HOL* OR TRAN=SMX* OR TRAN=SBI* OR TRAN=SAP*)) | bin _time span=15m | eval IntervalTime=strftime(_time,"%H.%M") | chart count(TRAN) as "Transaction Count" over IntervalTime by TRAN

Re: Search filter giving unexpected results

szimmer661 — Wed, 05 Oct 2016 19:30:08 GMT

That worked perfectly. Thanks for the help and the prompt reply.