Splunk Query provided wrong results

[Gowtham0809]

Hello,

Splunk query provided in correct responses. I have A query which filters the data on a specific day and provided the results. Here we index the CSV data every day by using CRCSALT= as we need the whole data set to be reindex even if there is no change in data set.

in the Query I have used a Eval command to print a value CAP-M1 , M2, M3 etc for each query outcome as a unique identifier. but by query provided corrects unique values while executing. for Example I have a Query A with unique value CAP-M1 and Query B suppose to print unique value as CAP-M2 but in the query B it keeps providing Value M1 instead of M2.

in the screen shot it suppose to print M4 for all days but its printing various values

Similarly for other searched also. Is this due to some cache memory issue in splunk?

Thanks

[to4kawa]

|eval Metric_ID="CAP-M4"
|eval ProjectCluster_Name="VRTE Platform"
|join type=inner DNGProjectAreaID max=0 [search index="usa_201920_test" |eval Date=strftime(_time,"%Y-%m-%d")|dedup Date ]

This join will update Metric_ID.
By the way, there are many join.

[Gowtham0809]

Thanks for your input,but the same join prints the Value CAP-M1 instead of CAP-M4, irrespective of what eval values been provided, result is CAP-M1, I guess something in spunk memory which is printing CAP-M1 by default in all queries.

Weirdly even without Eval command query results prints CAP-M1.

[to4kawa]

index="usa_201920_test" source=`Source_DNG_ProjectArea`
OR (source=`Source_DNG_RequirementModules` ModuleType="*" )
OR source=`Source_Sys_Validation`
OR source=`Source_RQM_Testcase` 
OR source=`Source_RQM_TestExecution`
OR (source=`Source_RQM_TestcaseResults` Verdict="" OR Verdict!="passed")
OR (source=`Source_DNG_SystemRequirements` SysReqType="System Requirement" )

To be honest, I think it would be faster and more appropriate to focus on source from this results.

[to4kawa]

No, your search results are exactly as you searched

[Gowtham0809]

There is no eval command for CAP-M1 or M11 or M7 is defined in the query, It was only M4 defined in the Query. I also get this error "Could not find object id=CAP-M4 " sometimes

The results should me CAp-M4 for all 4 rows.

[to4kawa]

Maybe your huge query is work.
but SPL is simple.
so, I say again. your search results are exactly as you searched

If you don't provide the query, nobody resolve your issue.