Splunk Enterprise

Results are miss match while using appedcols

marisstella
Explorer

Hello everyone,

I am getting incorrect values while using appendcols to fetch the different results like a currentweek, 1weekago,  2weeksago.

 

|bin _time span=1h |
stats count{trid) as transaction_count_1WAgo avg(duration) as Average RT_1WAgo by _time ABC | fields *
 
|appendcols [search earliest=** latest=** |
|bin _time span=1h
| stats count(trid) as transaction_count_2WAgo avg(duration) as Average RT_2WAgo by _time ABC | fields *
]
 
|appendcols [search earliest=** latest=** |
|bin _time span=1h |
stats count{trid) as transaction_count_currentweek avg(duration) as Average RT_currentweek by _time ABC| fields *]
 
If I run all this queries individually it shows some results and when I am trying to use them in a single search by appending using "appendcols" they shows different..
 
Please suggest on this?
Note: i have used all latest, earliest time frames correctly but didn't show here.
Labels (3)
0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...