Search filter giving unexpected results

[szimmer661]

I have the following search:

index=ironstream MFSOURCETYPE=SMF110 (SAPPLID=CSFBTP0* AND (TRAN=PA6* OR HOL* OR SMX* OR SBI* OR SAP*)) | bin _time span=15m | eval IntervalTime=strftime(_time,"%H.%M") | chart count(TRAN) as "Transaction Count" over IntervalTime by TRAN

Results are including transaction names like LGAB, MBRC and SFBC and don't include transaction names like SMXS and SMXU, for which we did have counts for the time frame selected.

Results from a similar search with the same filters, but that sums a numeric field yield closer to expected results, but include a transaction named COIE and again don't include the SMX* transactions.

I obviously don't understand something about the filtering and any help will be greatly appreciated.

[sundareshr · Accepted solution]

Assuming the field TRAN has been extracted. try this

index=ironstream MFSOURCETYPE=SMF110 (SAPPLID=CSFBTP0* AND (TRAN=PA6* OR TRAN=HOL* OR TRAN=SMX* OR TRAN=SBI* OR TRAN=SAP*)) | bin _time span=15m | eval IntervalTime=strftime(_time,"%H.%M") | chart count(TRAN) as "Transaction Count" over IntervalTime by TRAN

[szimmer661]

That worked perfectly. Thanks for the help and the prompt reply.