Splunk query discrepancy

[shangshin]

Hi,
I am sending apache web access log to splunk with one of the fields called user_id and I can see the field on the left panel.
Can anyone tell me the difference between the 2 queries below? I think the search result should be the same for both queries. However, the first query returns 0 result but the second query returned results with the field user_id = myuserid

Any idea?

sourcetype="apache.web.access" user_id="myuserid" | table _time, user_id, _raw

sourcetype="apache.web.access" | search user_id="myuserid" | table _time, user_id, _raw

[peter_krammer]

I have the same problem when I use automatic lookups.
If that is not the case it may be that you are searching in Fast or Smart Mode and the user_id field is not available in the first search run.

Your second query is differently handled by splunk because first a search is done on all data to find data with sourcetype "apache.web.access" and than a new search on the result data is startet, while the first query only runs one search against the data (which is more performant).

So try to change your search mode I hope it helps. (It did not in my case with the automatic lookup).

[shangshin]

Thanks for the response.

I just tried all 3 modes, fast, smart, verbose, but the result is still the same.