All Apps and Add-ons

Splunk query discrepancy


I am sending apache web access log to splunk with one of the fields called user_id and I can see the field on the left panel.
Can anyone tell me the difference between the 2 queries below? I think the search result should be the same for both queries. However, the first query returns 0 result but the second query returned results with the field user_id = myuserid

Any idea?

sourcetype="apache.web.access" user_id="myuserid" | table _time, user_id, _raw

sourcetype="apache.web.access" | search user_id="myuserid" | table _time, user_id, _raw


I have the same problem when I use automatic lookups.
If that is not the case it may be that you are searching in Fast or Smart Mode and the user_id field is not available in the first search run.

Your second query is differently handled by splunk because first a search is done on all data to find data with sourcetype "apache.web.access" and than a new search on the result data is startet, while the first query only runs one search against the data (which is more performant).

So try to change your search mode I hope it helps. (It did not in my case with the automatic lookup).

0 Karma


Thanks for the response.

I just tried all 3 modes, fast, smart, verbose, but the result is still the same.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...