topic Re: Why does the timechart command give different values than stats command? in Splunk Search

Why does the timechart command give different values than stats command?

umsundar2015 — Mon, 24 Apr 2017 14:29:57 GMT

Hi,

I am getting difference in count while using stats in piechart and with same search with timechart in line graph.

Can anyone help me with solution for this??

Regards,
Sundar

Re: Why does the timechart command give different values than stats command?

gcusello — Mon, 24 Apr 2017 14:37:06 GMT

hi umsundar2015,
did you used the same time period? try with a fixed period (e.g. yesterday) not "now" (e.g. last hour) because results are changing.
Bye.
Giuseppe

Re: Why does the timechart command give different values than stats command?

umsundar2015 — Mon, 24 Apr 2017 14:46:24 GMT

for pie chart i am using last 24 hours(total count is 5386) and trending chart i am using last 7 days and values are

_time Not Reporting Reporting
2017-04-18 1819 1400
2017-04-19 1819 1400
2017-04-20 1819 1400
2017-04-21 1819 1400
2017-04-22 1829 1400
2017-04-23 1829 1400
2017-04-24 1829 1400

can ypu suggest me a way to solve this issue ,

Re: Why does the timechart command give different values than stats command?

umsundar2015 — Mon, 24 Apr 2017 14:59:44 GMT

No i used different time period Like last 24hrs for piechart and last 7 days for trending chart .

Please suggest me way to make it equal ..

Re: Why does the timechart command give different values than stats command?

gcusello — Mon, 24 Apr 2017 15:10:35 GMT

Th problem is that if you use a time period until "now" the two searches take a little different time period so you'll have different results.
You can test this situation using a different time condition: instead now use: until last hour (@h), so you can verify that results of the last 24 hours are the same of the last column of you time chart.

You could try use a post process search in you dashboartd so you'll have the same search in both the panels, putting the condition "last 24 hours" as a secondary search.

Bye.
giuseppe

Re: Why does the timechart command give different values than stats command?

woodcock — Mon, 24 Apr 2017 15:42:16 GMT

We need BOTH search strings and also the timepicker details.

Re: Why does the timechart command give different values than stats command?

DalJeanis — Mon, 24 Apr 2017 22:48:36 GMT

Those results are unlikely to be from the same search.

Your pie chart has over 1.7 times as many results as your time chart, so the execution time difference of a few minutes is not the problem.

You have some additional criteria that is in place in one search that is not in the other, probably in terms of the aggregation. Just to eliminate any possiblity of that, though, you can add this to the beginning of your time chart search...

earliest=-7d@d latest =@d  (your search here)
| bin _time span=1d

...and add this to the beginning of your pie chart search...

earliest=-1d@d latest =@d  (your search here)
| bin _time span=1d

.. and the results will be forced to line up in the same 1-day bins.

Re: Why does the timechart command give different values than stats command?

umsundar2015 — Tue, 25 Apr 2017 07:37:17 GMT

Thank you Daljeanis .

It worked perfectly .

Re: Why does the timechart command give different values than stats command?

DalJeanis — Tue, 25 Apr 2017 15:04:09 GMT

@umsundar2015 - Great! If that solved your issue, then please mark this answer as "accepted".