Splunk Search

The same sql but different searche result

kavana
Explorer

The SPL below was ran in search bar and table in panel, but the search result are different.

Why the same SPL made different result?


source="after.csv" host="CDC311241" index="fuji_xerox_zhuwenbin" sourcetype="csv" "商談コード"=1410001001

|rename "ステータス" as status |dedup status

|eval process=if(status=="XXMB_ACTIVE","OK","NG")

|stats count(eval(process="OK")) AS OK,count(eval(process="NG")) AS NG BY "商談コード"

|eval porcessmid = if(OK>0 AND NG=0,"OK","NG")|table porcessmid

|append[search source="onetime.csv" host="CDC311241" index="fuji_xerox_zhuwenbin" sourcetype="csv" "商談コード"=1410001001

|rename "注文日" as chumonbi

|eval porcessmid = if(isnull(chumonbi),"NG","OK")

|table porcessmid]

|stats count(eval(porcessmid="OK")) AS OK,count(eval(porcessmid="NG")) AS NG

|eval processend = if(NG>0,"NG",if(OK>0,"OK","NG"))
|table processend

        |rename "契約連番" as aftercontractno,"取引番号" as torihikino|eval version =2  
        |JOIN type=inner aftercontractno version[search source="after.csv" host="CDC311241" index="fuji_xerox_zhuwenbin" sourcetype="csv" "商談コード"=1410001001  
        |rename "個別契約連番" as aftercontractno|eval version=2] |eval MB=substr(torihikino,0,2)     
        |eval process = if(MB=="MB","OK","NG") |appendpipe [stats count | eval process = "OK" | eval somecolumn = 0 | where count==0] |table process    
        |append[search source="seikyuzumi_code.csv" host="CDC311241" index="1012test" sourcetype="csv"  
        |rename "契約連番" as aftercontractno,"発行F" as excuteflag   
        |JOIN type=inner aftercontractno [search source="after.csv" host="CDC311241" index="fuji_xerox_zhuwenbin" sourcetype="csv" "商談コード"=1410001001     
        |rename "個別契約連番" as aftercontractno|eval version=2  
        |JOIN type=inner aftercontractno version[search source="afterrireki.csv" host="CDC311241" index="1012test" sourcetype="csv"     
        |rename rireki as version,"個別契約連番" as aftercontractno]]     
        |eval process = if(excuteflag=="1","OK","NG") |appendpipe [stats count  
        | eval process = "NG" |eval somecolumn = 0 | where count==0] |table process]    
        |stats count(eval(process="OK")) AS OK,count(eval(process="NG")) AS NG  
        |eval processend = if(NG>0,"NG",if(OK>0,"OK","NG")) |table processend]  
        |stats count(eval(processend="OK")) AS OK,count(eval(processend="NG")) AS NG    
        |eval processendTWO = if(NG>0,"NG",if(OK>0, "OK","NG"))     
        |table processendTWO |eval severity=case(processendTWO="OK", 5, processendTWO="NG", 50)     
        |rangemap field=severity low=1-30 elevated=31-39 default=severe 

Tags (1)
0 Karma

renjith_nair
Legend

You might need to give little more details like what are the differences in result etc.

Most probably, it has something to do with field extraction due to search mode. You might be executing the search in search bar with verbose mode where as in dashboard panel, it's smart mode by default.

You can verify this by opening the search result in search bar from table and see the difference

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...