search is returning distinct values

[email2vamsi]

Hi Experts,

|search filed1=Enabled OR "Enabled" OR "Disabled" OR Disabled
The above search is returning four rows.
If i try to sum them based on the status ,still its returning four rows.
|stats sum(dc(servers)) by Status

Status---> dc(servers)
Enabled--> 10
Enabled--> 3
Disabled-> 23
Disabled->6

Thank you.

[email2vamsi]

@ITWhisperer 

|search filed1=Enabled OR "Enabled" OR "Disabled" OR Disabled

From the above search Enabled returns one row in search,
"Enabled" in double quotes returns second row,
Disabled returns third row and "Disabled" in double quotes returns fourth row.

Field1---> dc(servers)
Enabled--> 10
Enabled--> 3
Disabled-> 23
Disabled->6

[ITWhisperer]

So, your data actually has double quotes sometimes and not others - therefore these are different which is why you get 4 rows - you will have to manipulate the data in some way to get them to be the same e.g. strip the double quotes from the fields which have them.

[PickleRick]

You're getting something wrong.

In a search with

field1=Enabled OR Enabled

the first "subcondition" is not needed because it will match all occurences of "Enabled" within the whole event (ok, there might be a slightly tricky case with calculated/looked up fields but I'm not sure here - would have to test).

Similar thing goes for

Disabled OR "Disabled"

Since "Disabled" is just one word, you're searching twice for the same term.

So there is no mechanism that "returns four rows" here.

You're not showing us the whole picture.

[ITWhisperer]

There doesn't appear to be sufficient information presented to determine what is not working for you. What are the four events returned by the first search?