Splunk Search

Why is Appending two search queries with different conditions giving me the same results?

monyathomas
New Member

I have two survey types "a" and "b" and there are two details need to be displayed as 'a%' (For all kind of "Data") and 'a1%" (For "Data"="N/A" OR "Data"="Yes" ) .However when I am using append and trying the below query , I see that both the columns a% and a1% are displaying the same results.

index="xyz"
| fillnull "Data" value="N/A"
|chart count over "Survey Month" by "Survey Type"
| addtotals
|rename Total as "Grand Total"
| eval "a%"=round(('a'/'Grand Total')*100,2)
| eval "a%"='a%'+"%"
| table "Survey Month","a","b","a%"
|append[search "Data"="N/A" OR "Data"="Yes"
| chart count over "Survey Month" by "Survey Type"]|addtotals
| rename Total as "Grand Total"
| eval "a1%"=round(('a'/'Grand Total')*100,2)
| eval "a1%"='a1%'+"%"
| table "Survey Month","a%","a1%"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are the two queries really different? They look different, but perhaps index "xyz" only contains events with the Data field of "N/A or "Yes". And maybe events with the Data field of "N/A or "Yes" only exist in index "xyz". Base searches should be as specific as possible without eliminating desired events.

---
If this reply helps you, Karma would be appreciated.
0 Karma

monyathomas
New Member

Yes, the queries are different. And, the Data field consists - "N/A","Yes","No" and "Exception Scenario" and all of them exist in the index "xyz" . However,while using the above search query I am not able to retrieve the data as per my expectation.Kindly suggest a way forward.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...