Splunk Search

Why is Appending two search queries with different conditions giving me the same results?

New Member

I have two survey types "a" and "b" and there are two details need to be displayed as 'a%' (For all kind of "Data") and 'a1%" (For "Data"="N/A" OR "Data"="Yes" ) .However when I am using append and trying the below query , I see that both the columns a% and a1% are displaying the same results.

index="xyz"
| fillnull "Data" value="N/A"
|chart count over "Survey Month" by "Survey Type"
| addtotals
|rename Total as "Grand Total"
| eval "a%"=round(('a'/'Grand Total')*100,2)
| eval "a%"='a%'+"%"
| table "Survey Month","a","b","a%"
|append[search "Data"="N/A" OR "Data"="Yes"
| chart count over "Survey Month" by "Survey Type"]|addtotals
| rename Total as "Grand Total"
| eval "a1%"=round(('a'/'Grand Total')*100,2)
| eval "a1%"='a1%'+"%"
| table "Survey Month","a%","a1%"

0 Karma

SplunkTrust
SplunkTrust

Are the two queries really different? They look different, but perhaps index "xyz" only contains events with the Data field of "N/A or "Yes". And maybe events with the Data field of "N/A or "Yes" only exist in index "xyz". Base searches should be as specific as possible without eliminating desired events.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

Yes, the queries are different. And, the Data field consists - "N/A","Yes","No" and "Exception Scenario" and all of them exist in the index "xyz" . However,while using the above search query I am not able to retrieve the data as per my expectation.Kindly suggest a way forward.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!