Field alias showing improper count - splunk 4.3.2 ??

[rakesh_498115]

Hi ,

I have two field extractions like the below ones in my props.conf file.now i have created an alias for these two extractions as Product i.e

[productinfo]
EXTRACT-t2r_b2b_prodID = ServiceType>(?<t2r_b2b_prodID>[^<]*)<
EXTRACT-b2b_prodID = (?<=SellersItemIdentification).*?\s*\<.*?ID\>(?<b2b_prodID>[^<]*)\<
FIELDALIAS-prodID = b2b_prodID AS Product t2r_b2b_prodID AS Product

// query1
sourcetype="productinfo" | top b2b_prodID

is having 10 products info

// query2
sourcetype="productinfo" | top t2r_b2b_prodID

is having 5 products info

but wen i run
//query 3
sourcetype="productinfo" | top Product

it should show 15 products info and count should match.. but this not matching.. can any one help wats been wrong here ..pls

[lpolo]

Try this:

sourcetype="productinfo" | top limit=0 Product 

[rakesh_498115]

yeah tried that . its not problem with the query .its problem with the count ...say in my first query i am getting a product A with count 100 and in second query i am A count 50 , then ideally in third query A count should be 150 but it is not... 😞

[dsrvern]

Hi rakesh,

I'm seeing the same problem with field aliases. Did you ever find a solution to this issue?