The same sql but different searche result

[kavana]

The SPL below was ran in search bar and table in panel, but the search result are different.

Why the same SPL made different result?

---

source="after.csv" host="CDC311241" index="fuji_xerox_zhuwenbin" sourcetype="csv" "商談コード"=1410001001

|rename "ステータス" as status |dedup status

|eval process=if(status=="XXMB_ACTIVE","OK","NG")

|stats count(eval(process="OK")) AS OK,count(eval(process="NG")) AS NG BY "商談コード"

|eval porcessmid = if(OK>0 AND NG=0,"OK","NG")|table porcessmid

|append[search source="onetime.csv" host="CDC311241" index="fuji_xerox_zhuwenbin" sourcetype="csv" "商談コード"=1410001001

|rename "注文日" as chumonbi

|eval porcessmid = if(isnull(chumonbi),"NG","OK")

|table porcessmid]

|stats count(eval(porcessmid="OK")) AS OK,count(eval(porcessmid="NG")) AS NG

|eval processend = if(NG>0,"NG",if(OK>0,"OK","NG"))
|table processend

        |rename "契約連番" as aftercontractno,"取引番号" as torihikino|eval version =2  
        |JOIN type=inner aftercontractno version[search source="after.csv" host="CDC311241" index="fuji_xerox_zhuwenbin" sourcetype="csv" "商談コード"=1410001001  
        |rename "個別契約連番" as aftercontractno|eval version=2] |eval MB=substr(torihikino,0,2)     
        |eval process = if(MB=="MB","OK","NG") |appendpipe [stats count | eval process = "OK" | eval somecolumn = 0 | where count==0] |table process    
        |append[search source="seikyuzumi_code.csv" host="CDC311241" index="1012test" sourcetype="csv"  
        |rename "契約連番" as aftercontractno,"発行F" as excuteflag   
        |JOIN type=inner aftercontractno [search source="after.csv" host="CDC311241" index="fuji_xerox_zhuwenbin" sourcetype="csv" "商談コード"=1410001001     
        |rename "個別契約連番" as aftercontractno|eval version=2  
        |JOIN type=inner aftercontractno version[search source="afterrireki.csv" host="CDC311241" index="1012test" sourcetype="csv"     
        |rename rireki as version,"個別契約連番" as aftercontractno]]     
        |eval process = if(excuteflag=="1","OK","NG") |appendpipe [stats count  
        | eval process = "NG" |eval somecolumn = 0 | where count==0] |table process]    
        |stats count(eval(process="OK")) AS OK,count(eval(process="NG")) AS NG  
        |eval processend = if(NG>0,"NG",if(OK>0,"OK","NG")) |table processend]  
        |stats count(eval(processend="OK")) AS OK,count(eval(processend="NG")) AS NG    
        |eval processendTWO = if(NG>0,"NG",if(OK>0, "OK","NG"))     
        |table processendTWO |eval severity=case(processendTWO="OK", 5, processendTWO="NG", 50)     
        |rangemap field=severity low=1-30 elevated=31-39 default=severe 

---

[renjith_nair]

You might need to give little more details like what are the differences in result etc.

Most probably, it has something to do with field extraction due to search mode. You might be executing the search in search bar with verbose mode where as in dashboard panel, it's smart mode by default.

You can verify this by opening the search result in search bar from table and see the difference