i am getting two diffrent results in total. query1 is providing acurate result.
query2 as soom as adding |lookup locationdetails.csv City AS City total value to less than acurate one
using splunk version 7.3.71
query1
index=xyz source=xyz
|eval Month=strftime(_time,"%b %Y")
|search Month="Mar 2021"
|search Product In (Sold,Damaged)
|stats count(Product) as Total
query 2
index=xyz source=xyz
|eval Month=strftime(_time,"%b %Y")
|search Month="Mar 2021"
|search Product in (Sold,Damaged)
|lookup locationdetails.csv City AS City
|stats count(Product) as Total
What are the fields in the lookup file?
Seems strange indeed. Are you sure that your lookup doesn't overwrite Product field somehow? (you're not specifying output fields)