Splunk Search

adding lookup in query ending with incorrect result

abdul
Explorer

i am getting two diffrent results in total. query1 is providing acurate result. 

query2 as soom as adding |lookup locationdetails.csv City AS City total value to less than acurate one
using splunk version 7.3.71

query1
index=xyz source=xyz 
|eval Month=strftime(_time,"%b %Y")
|search Month="Mar 2021"
|search Product In (Sold,Damaged)
|stats count(Product) as Total 


query 2
index=xyz source=xyz 
|eval Month=strftime(_time,"%b %Y")
|search Month="Mar 2021"
|search Product in (Sold,Damaged)
|lookup locationdetails.csv City AS City
|stats count(Product) as Total 

Labels (1)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

What are the fields in the lookup file?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Seems strange indeed. Are you sure that your lookup doesn't overwrite Product field somehow? (you're not specifying output fields)

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...