How to search on nested fields not returning the right results?

[rxvichi]

The search which is fetching based on one of the nested fields "labels.errorCode" does not return the same results,query returning the wrong number of results

This search below returns the right results. But we would like to search based on the field labels.errorCode.

query returning the right number of results

[bowesmana]

Your searches are different - one searches labels.errrorCode=9001 and the other searches with other search strings. Why is 29 results in your first search "wrong" - what is wrong?

Is it returning 29 results that do NOT have labels.errorCode=9001 - you have redacted the data in that, so I can't know

Is 154,465 results the correct number of results which contain labels.errorCode=9001?

[rxvichi]

Sorry I made it a bit confusing. The first search result does not return the values returned in the second search result even though the second search result has labels.errorCode=9001. The first search does not return all the values it just returns a subset. Also the redacted data is the same in both queries.

[bowesmana]

Are the JSON fields being auto extracted in all cases and what is the length of the JSON data? Best thing to diagnose is to focus on a single event that you can see has errorCode=9001, but is not found in the search and understand why that event is not found.

If can be that the field does not exist (i.e. it is not a Splunk field, as opposed to it not existing in the data) prior to the search.

When you have a single search result that does not work, look at the extracted field table on the left and see what fields Splunk thinks it has.