Iam getting different outputs for same query

[krishna1]

Iam getting different results for same query when checked in statistics and visualizations, Attaching both screenshots

[ITWhisperer · Accepted solution]

The data in the chart is consistent with the data in the table - the issue is that the chart is treating _time as a special case of field - you can get around this by creating a new field called time and removing _time - you would need to ensure that the time field is listed first so that it becomes the x-axis

| gentimes start=-365
| rename starttime as _time 
| fields _time
| eval location=mvindex(split("ABCDEFGH",""),random()%8)
``` the lines above generate random data for testing ```
| timechart span=1mon count by location
| tail 6
| eval time=strftime(_time,"%Y-%m")
| fields - _time
| table time *

[krishna1]

Thank you! It is working

[PickleRick]

What do you mean by "different results"? They seem pretty much consistent.

[krishna1]

in table , _time is converted into month buckets but in chart, in X-axis its not getting showing monthly buckets

[PickleRick]

That's simply how Splunk shows the _time field. The data is consistent, the presentation might indeed be a bit confusing. You can get  around it as @ITWhisperer showed already.