Multiple "where like" on a CSV file

[nqjpm]

The CSV has over 100k entries. When I timechart this search I see about 6800 results. I receive values for all 3 months I searched. However, when I table the same search and I click the GUI sort on TIME I am only seeing Jan and Feb. The results from the search shows the same number 6800. Is there some limitation to populating tables I am unaware of when dealing with CSV's? or Is there possibly something wrong with my WHERE statement?

| inputlookup foo.csv
| eval output=toString(Date) + " " + (CreatedHour)
| eval _time=strptime(output,"%b %d,%Y %I:%M%p")
| eval TIME=strftime(_time, "%b-%d-%Y %I:%M %p")
| dedup IncidentId
| where like(TIME, "Jan%") OR like(TIME, "Feb%") OR like(TIME, "Mar%")
| where like(Queue, "In-Country%")
| sort -_time
| table Queue IncidentId TIME

[nqjpm]

1) The dedup command is throwing away some results.
Realize now this is not the appropriate location to use this. Thanks good catch.

2) It makes no sense to sort on "TIME" since your date format is not sortable.
Changed to sort on _time

3) Sort has a limit on how many records it will return. Use | sort 0 to eliminate the limit.
When I tried | sort 0 it errors out to "You must specify fields to sort."

4) Can an IncidentId be in more than one Queue? If so, did you want only the final one?
Yes it can be in more than one Queue and I am seeking the final one as you surmised.

[DalJeanis]

1) The dedup command is throwing away some results.

2) It makes no sense to sort on "TIME" since your date format is not sortable.

3) Sort has a limit on how many records it will return. Use | sort 0 to eliminate the limit.

4) Can an IncidentId be in more than one Queue? If so, did you want only the final one?