Splunk query provided in correct responses. I have A query which filters the data on a specific day and provided the results. Here we index the CSV data every day by using CRCSALT= as we need the whole data set to be reindex even if there is no change in data set.
in the Query I have used a Eval command to print a value CAP-M1 , M2, M3 etc for each query outcome as a unique identifier. but by query provided corrects unique values while executing. for Example I have a Query A with unique value CAP-M1 and Query B suppose to print unique value as CAP-M2 but in the query B it keeps providing Value M1 instead of M2.
in the screen shot it suppose to print M4 for all days but its printing various values
Similarly for other searched also. Is this due to some cache memory issue in splunk?
There is no eval command for CAP-M1 or M11 or M7 is defined in the query, It was only M4 defined in the Query. I also get this error "Could not find object id=CAP-M4 " sometimes
The results should me CAp-M4 for all 4 rows.
Maybe your huge query is work.
but SPL is simple.
so, I say again.
your search results are exactly as you searched
If you don't provide the query, nobody resolve your issue.
|eval Metric_ID="CAP-M4" |eval ProjectCluster_Name="VRTE Platform" |join type=inner DNGProjectAreaID max=0 [search index="usa_201920_test" |eval Date=strftime(_time,"%Y-%m-%d")|dedup Date ]
join will update MetricID_.
By the way, there are many
Thanks for your input,but the same join prints the Value CAP-M1 instead of CAP-M4, irrespective of what eval values been provided, result is CAP-M1, I guess something in spunk memory which is printing CAP-M1 by default in all queries.
Weirdly even without Eval command query results prints CAP-M1.
index="usa_201920_test" source=`Source_DNG_ProjectArea` OR (source=`Source_DNG_RequirementModules` ModuleType="*" ) OR source=`Source_Sys_Validation` OR source=`Source_RQM_Testcase` OR source=`Source_RQM_TestExecution` OR (source=`Source_RQM_TestcaseResults` Verdict="" OR Verdict!="passed") OR (source=`Source_DNG_SystemRequirements` SysReqType="System Requirement" )
To be honest, I think it would be faster and more appropriate to focus on
source from this results.