Splunk search bug on all data index but work well on few data

[cros]

Hi all, 

I'm creating couple of events with command : 

| streamstats window=2 list(PI_Event_Status) as status list(PI_Event_Time) as time list("PI Event Severity") as severity list("PI Event Urgency") as urgency by "Record Number", "PI Number" 

I notice that when i execute my command only on one "Record Number" (record number is an id) the command works as expected : 

But when i execute the command on all index the command works partially : 

Do you know why ? 

Regards,

Clément

[ITWhisperer · Accepted solution]

Streamstats with a window of 2 is only looking at the current and previous event. By filtering on record name, you are guaranteeing that the two events will fit the by clause. Without the filter, the previous event might not be the same record type, hence only one time/status/etc. in your lists. In order to get the results you are expecting you could try sorting by record type and time prior to the streamstats, although I suspect that possibly defeats the purpose of using streamstats in the first place.

[cros]

@ITWhisperer thank you for your quick answer. 

I added the sort as you recommend it.

| sort "Record Number", "PI Number", time

 It seems to works well thank you