Difference in Queries

[koushiknandan]

Hi,

Though I'm receiving the same output for both my queries, curious to know the difference (executions, time taken, etc) between them.
The bold part is the only change.

index=PD host=ABC* uri="/XXXX" AND (http_status="200" OR http_status="500") | convert timeformat="%Y-%m-%d" ctime(_time) AS Date | stats count(eval(http_status="200")) as "HTTP 200", count(eval(http_status="500")) as "HTTP 500" by Date

index=PD host=ABC* uri="/XXXX" | convert timeformat="%Y-%m-%d" ctime(_time) AS Date | stats count(eval(http_status="200")) as "HTTP 200", count(eval(http_status="500")) as "HTTP 500" by Date

Thanks

[wpreston · Accepted solution]

Splunk gives the kind of information you're looking for in the job inspector. Take a look at it for each of your searches by clicking job --> inspect job and see if it has what you need.