Why are there multiple values on the test instance in timestartpos and timeendpos fields?

[nemaden]

I extracted sample data from our prod instance of Splunk to be used in the test instance. The way I did it was to run a search in prod instance, export the results to CSV and then upload into test instance. Everything seems so to correct the data except the timeendpos and timestart pos values.

Some how on the test instance the timeendpos and timestartpos seem to have two sets values for each row of data.

If I run the following query

index=xyz  user="john" | table user, date_hour, date_minute,  timestartpos, timeendpos

In prod it returns

john  16  33 10  24

but the same query on test returns

john   16 33 10  24
blank 16 33  92  102

So loading the data in test seems to have introduced extra values for timestartpos and timeendpos, 92 and 102 respectively.
Unfortunately, I can't post a properly formatted output.

Does anyone know why this is happening and how to resolve the issue?

[deepashri_123]

Hey@nemaden,

Any reason to use date_hour and date_minute ? Instead use _time.
date_hour field will give you values for all 24 hrs for any date that comes in the log.I assume this is your problem.
Please try and report if this helps!!

[nemaden]

First I am not saying there are two lines, just that the timestartpos and timeendpos have additional values. That is these two fields have become multi value fields. Secondly, I need date_hour in the output of query for later use.