For some reason my |tstats count query is returning a result of 0 when I add an OR condition in my where clause if the field doesn't exist in the dataset, or if the OR condition specifies a string value when the value for the field in the data is always an integer. For example: This query returns the correct event count (or at least it's non-zero): |tstats count where index="my_index" eventOrigin="api"
(accountId="8674756857") Adding this OR condition returns a count of zero -- why? Note that for this time range there are no events with a serviceType field, but for other time ranges there are events with a serviceType field. |tstats count where index="my_index" eventOrigin="api"
(accountId="8674756857" OR serviceType="unmanaged") Adding this OR condition also returns zero -- why? It's true that accountId should normally be an integer, but it's an OR, so I still expect it to count those events. |tstats count where index="my_index" eventOrigin="api"
(accountId="19783038942" OR accountId="aaa") Using a * results in the same non-zero count as the first query, which is expected, even though there are no events with a serviceType field: |tstats count where index="my_index" eventOrigin="api"
(accountId="8674756857" OR serviceType="unmana*") Why would adding an OR condition in tstats cause the count to be zero? The same problem does not occur with a regular search query. I am on Splunk 9.1.0.2.
... View more