Splunk Search

adding lookup in query ending with incorrect result

abdul
Explorer

i am getting two diffrent results in total. query1 is providing acurate result. 

query2 as soom as adding |lookup locationdetails.csv City AS City total value to less than acurate one
using splunk version 7.3.71

query1
index=xyz source=xyz 
|eval Month=strftime(_time,"%b %Y")
|search Month="Mar 2021"
|search Product In (Sold,Damaged)
|stats count(Product) as Total 


query 2
index=xyz source=xyz 
|eval Month=strftime(_time,"%b %Y")
|search Month="Mar 2021"
|search Product in (Sold,Damaged)
|lookup locationdetails.csv City AS City
|stats count(Product) as Total 

Labels (1)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

What are the fields in the lookup file?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Seems strange indeed. Are you sure that your lookup doesn't overwrite Product field somehow? (you're not specifying output fields)

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...