Splunk Search

Why is Appending two search queries with different conditions giving me the same results?

monyathomas
New Member

I have two survey types "a" and "b" and there are two details need to be displayed as 'a%' (For all kind of "Data") and 'a1%" (For "Data"="N/A" OR "Data"="Yes" ) .However when I am using append and trying the below query , I see that both the columns a% and a1% are displaying the same results.

index="xyz"
| fillnull "Data" value="N/A"
|chart count over "Survey Month" by "Survey Type"
| addtotals
|rename Total as "Grand Total"
| eval "a%"=round(('a'/'Grand Total')*100,2)
| eval "a%"='a%'+"%"
| table "Survey Month","a","b","a%"
|append[search "Data"="N/A" OR "Data"="Yes"
| chart count over "Survey Month" by "Survey Type"]|addtotals
| rename Total as "Grand Total"
| eval "a1%"=round(('a'/'Grand Total')*100,2)
| eval "a1%"='a1%'+"%"
| table "Survey Month","a%","a1%"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are the two queries really different? They look different, but perhaps index "xyz" only contains events with the Data field of "N/A or "Yes". And maybe events with the Data field of "N/A or "Yes" only exist in index "xyz". Base searches should be as specific as possible without eliminating desired events.

---
If this reply helps you, Karma would be appreciated.
0 Karma

monyathomas
New Member

Yes, the queries are different. And, the Data field consists - "N/A","Yes","No" and "Exception Scenario" and all of them exist in the index "xyz" . However,while using the above search query I am not able to retrieve the data as per my expectation.Kindly suggest a way forward.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...