topic Re: Duplicated values on count in Getting Data In

Duplicated values on count

vinihei_987 — Tue, 12 Mar 2024 15:59:07 GMT

When I do an stats count my field it return the double of the real number

index=raw_fe5_autsust Aplicacao=HUB Endpoint="*/" | eval Agrupamento=if(Agrupamento!="", Agrupamento, "AGRUPAMENTO_HOLDING/CE") | eval Timestamp=strftime(_time, "%Y-%m-%d") | stats count by Agrupamento, Timestamp | sort -Timestamp

I already tried dedup and when I count only by Timestamp it works fine

Re: Duplicated values on count

richgalloway — Tue, 12 Mar 2024 14:21:01 GMT

It's not clear what the problem is. Are you seeing repeated results or are the counts twice the expected values? It may help to share sanitized output.

Re: Duplicated values on count

gcusello — Tue, 12 Mar 2024 14:22:57 GMT

Hi @vinihei_987 ,

are yousure that in some events you have only one Agrupamento?

probaby they are more than one in some (or all) events, so you have a total greter than events.

Ciao.

Giuseppe

Re: Duplicated values on count

ITWhisperer — Tue, 12 Mar 2024 14:24:09 GMT

If Agrupamento is a multi-value field, it will be counted for each value in the multivalue field

| makeresults | eval field=split("AA","") | stats count by field _time