Splunk Search

Why is Appending two search queries with different conditions giving me the same results?

New Member

I have two survey types "a" and "b" and there are two details need to be displayed as 'a%' (For all kind of "Data") and 'a1%" (For "Data"="N/A" OR "Data"="Yes" ) .However when I am using append and trying the below query , I see that both the columns a% and a1% are displaying the same results.

index="xyz"
| fillnull "Data" value="N/A"
|chart count over "Survey Month" by "Survey Type"
| addtotals
|rename Total as "Grand Total"
| eval "a%"=round(('a'/'Grand Total')*100,2)
| eval "a%"='a%'+"%"
| table "Survey Month","a","b","a%"
|append[search "Data"="N/A" OR "Data"="Yes"
| chart count over "Survey Month" by "Survey Type"]|addtotals
| rename Total as "Grand Total"
| eval "a1%"=round(('a'/'Grand Total')*100,2)
| eval "a1%"='a1%'+"%"
| table "Survey Month","a%","a1%"

0 Karma

SplunkTrust
SplunkTrust

Are the two queries really different? They look different, but perhaps index "xyz" only contains events with the Data field of "N/A or "Yes". And maybe events with the Data field of "N/A or "Yes" only exist in index "xyz". Base searches should be as specific as possible without eliminating desired events.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

Yes, the queries are different. And, the Data field consists - "N/A","Yes","No" and "Exception Scenario" and all of them exist in the index "xyz" . However,while using the above search query I am not able to retrieve the data as per my expectation.Kindly suggest a way forward.

0 Karma