topic Re: Returning incorrect count from Splunk stats command in Alerting

Returning incorrect count from Splunk stats command

Ganesh1 — Tue, 26 Mar 2024 18:02:41 GMT

Hi Splunk team,
We have been using similar below Splunk query across 15+ Splunk alerts but the count mentioned in email shows 4 times of actual failure occurrence.

index="<your_index>" sourcetype="<your_sourcetype>" source="<your_source.log>" Business_App_ID=<your_appid> Object=* (Failure_Message=*0x01130006* OR Failure_Message=*0x01130009*) | stats count by Object, Failure_Message | sort count

Below Splunk query is returning correct failure events.

index="<your_index>" sourcetype="<your_sourcetype>" source="<your_source.log>" Business_App_ID=<your_appid> Object=* (Failure_Message=*0x01130006* OR Failure_Message=*0x01130009*)

Can you please help in updating the Splunk query(mentioned 1st) to show correct count instead wrong one?

Re: Returning incorrect count from Splunk stats command

ITWhisperer — Tue, 26 Mar 2024 11:06:21 GMT

There is insufficient information to be able to determine what might be amiss. For example, if your events have multi-value fields, this can give unexpected counts. Please share some representative anonymised examples of your events.

Re: Returning incorrect count from Splunk stats command

gcusello — Tue, 26 Mar 2024 14:27:21 GMT

Hi @Ganesh1 ,

If the events are less than the total count in stats ,check i the fields Object and Failure_Message are present in all the events or only in a subset of them, and eventually not both in the same events.

If the events are freater than the total count in stats, probably you have more values in the same events.

because probably the issue is related to the fact that a stats count BY two fields returns the count of results with both the fields containing a value.

Ciao.

Giuseppe