Hi,
Has anyone an idea what could be the reason why before an update was able to run a query and get correct results but after updating to 8.2.9 getting random results. The data is in the event data, I can find the specific data if I specify for one specific but if I run the query I can get 1 result, 15 results, 42 results so on. Running the same query within the same timeframe.
We have over 1500 Indexes and it seems to only be issue with one specific index. It does seem odd that when running it the data is there if I use specific user=123 instead of using user=* but then I would only get results for user 123. I tried even adding user=123 OR user=* does not change anything just random results.
Could it be something that needs to be cleared or something?
Has anyone seen this before?
index=ABC operation=Paymentcompleted PAYMENT_METHOD=* user=* firstName=* lastName=* jurisdiction=UK AMOUNT=* country=GB | dedup user
| eval NameofPayer = FIRST_NAME." ".LAST_NAME
| eval NameofCust = firstName." ".lastName
| eval NameofCust=upper(NameofCust)
| eval NameofPayer=upper(NameofPayer)
| where NOT match(NameofPayer,NameofCust)
| stats list(NameofPayer) as NameofPayer, list(NameofCust) as NameofCust by user | fieldformat Time = strftime(Time, "%Y-%m-%d %H:%M:%S")
Running Stats list, values or tables does not make a difference to the random results.
While this should be over 140 results.
Thank you in advanced,
