All Apps and Add-ons

Splunk query discrepancy


I am sending apache web access log to splunk with one of the fields called user_id and I can see the field on the left panel.
Can anyone tell me the difference between the 2 queries below? I think the search result should be the same for both queries. However, the first query returns 0 result but the second query returned results with the field user_id = myuserid

Any idea?

sourcetype="apache.web.access" user_id="myuserid" | table _time, user_id, _raw

sourcetype="apache.web.access" | search user_id="myuserid" | table _time, user_id, _raw


I have the same problem when I use automatic lookups.
If that is not the case it may be that you are searching in Fast or Smart Mode and the user_id field is not available in the first search run.

Your second query is differently handled by splunk because first a search is done on all data to find data with sourcetype "apache.web.access" and than a new search on the result data is startet, while the first query only runs one search against the data (which is more performant).

So try to change your search mode I hope it helps. (It did not in my case with the automatic lookup).

0 Karma


Thanks for the response.

I just tried all 3 modes, fast, smart, verbose, but the result is still the same.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...