Append and lookup

[kangje168]

Hello,
We have 2 log files with a coloum in common. I saved the first search and use "lookup" to connect it to the second search.
While my colleague, he use "append". We got two very close result, but they are not the same. Just 1 or 2 different in the total number in the result. Could anybody told me, whose search is more precise? Or under what circumustance, "lookup", or "append", is more precise ?

Thank you very much.

[xpac]

In general, both variants are precise. However, lookup uses data saved before, so it might be a little less recent than append, simply because the data has changed in the meantime.

If your data did not change inbetween, I would try to do a search in the results, to find out what exactly makes for those "off by 1-2" differences - because then they should yield the same results.