Splunk query not producing expected result

[ravimishrabglr]

Below query is producing expected result only sometime, but not working for similar data on some other random days.

Query:

index=my_summary source=app_response_status report=app_response_status ApiName=metadata
| timechart span=1d sum("200"), sum("404")

Working Data:

10/24/2021 00:00:00 +0000, search_name=app_response_status, search_now=1635123600.000, info_min_time=1635033600.000, info_max_time=1635120000.000, info_search_time=1635124485.280, 200=7552, 404=7582, ApiName=metadata, info_sid=scheduler__gmrm_VkEtdm1lLXJ0bXMtc2g__RMD50cd89fe00e4c64f8_at_1635123600_39072, RowTotals=15134, info_max_time="1635120000.000", info_min_time="1635033600.000", info_search_time="1635124485.280", report=app_response_status

Screenshot 2021-10-25 at 5.18.46 PM.png

Not Working Data:

09/03/2021 00:00:00 +0000, search_name=app_response_status, search_now=1630717200.000, info_min_time=1630627200.000, info_max_time=1630713600.000, info_search_time=1630717575.202, 200=9483, 404=5287, ApiName=metadata, info_sid=scheduler__gmrm_VkEtdm1lLXJ0bXMtc2g__RMD50cd89fe00e4c64f8_at_1630717200_72746, RowTotals=14770, info_max_time="1630713600.000", info_min_time="1630627200.000", info_search_time="1630717575.202", report=app_response_status 

Screenshot 2021-10-25 at 5.20.17 PM.png

I am not able to figure out the problem, both data looks same to me, but not sure why it is not working. pls help.

[PickleRick]

Probably depends on what parsing rules you have for this sourcetype. Try to search for the first event and do

| table *

on it. Then do the same with the other one.

I'm not sure if you're not having some extra spaces before/after commas in one of the events but I can't tell if this breaks your parsing.