looks like I found the answer for my issue. As I suspected its not the issue with _raw field rather It is verbose search mode. When I use smart mode results are consistent but not with verbose mode. And strangely results are not matching with different search mode. ie, verbose and smart mode results are not matching.
I have asked Splunk support about strange behavior of search modes, they are investigating. This Seems to be bug as per [https://answers.splunk.com/answers/343834/why-am-i-getting-three-different-results-running-a.html] but splunk haven't confirmed me yet.
I am using 6.3.2.
I will keep posted once I hear from Splunk support.
Since I got an answer to my original question. I am marking this as answered.
... View more