Why Stats count command is counting events that are missing in other searches?

[abhijeetallu]

The first search query returns a count of 26 for domain X :

index="web" sourcetype="weblogic_stdout" loglevel IN ("Emergency") | stats count by domain

But when I run the below query to just see the events corresponding to domain=X, I get zero events:

 index="web" sourcetype="weblogic_stdout" loglevel IN ("Emergency") domain="X"

Any clue why this might be happening

[bowesmana · Accepted solution]

That generally means X is not X, i.e. if you put 

index="web" sourcetype="weblogic_stdout" loglevel IN ("Emergency") domain="*X*"

do you get results

If you do this in your first search

index="web" sourcetype="weblogic_stdout" loglevel IN ("Emergency")
| eval trimmed_domain=trim(domain)
| eval bounded_domain=":".domain.":"
| stats count by domain trimmed_domain bounded_domain
| eval trimmed_equal_domain=if(trimmed_domain=domain, "YES", "NO")

you may see whether you have leading or trailing spaces around X and if trimmed_equal_domain is NO, then there are leading/trailing spaces.

The bounded domain makes it easier to see what's what by adding : before and after

[abhijeetallu]

Thank you so much ! it worked. I was clueless what was happening and all this time it was a trailing space character !