https://community.splunk.com/t5/Splunk-Search/Why-does-the-quot-tstats-count-quot-and-quot-tstats-values-quot/m-p/417340#M120087 <P><EM>count(X)</EM><BR /><BR /> This function returns the number of occurrences of the field X. </P> <P><EM>values(X)</EM> <BR /> This function returns the list of all distinct values of the field X as a multi-value entry. The order of the values is lexicographical.</P> <P>this is from stats command page.. this will be applicable for tstats as well, i think<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions</A></P> <P><EM>As you are a new user to Splunk Answers, you can upvote the answers/comments, <BR /> if this answer resolved your query, you can select this answer and "accept" it as the answer, so that this question will be moved to answered queue. Happy Splunking!</EM></P> Mon, 03 Dec 2018 05:21:06 GMT inventsekar 2018-12-03T05:21:06Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-quot-tstats-count-quot-and-quot-tstats-values-quot/m-p/417339#M120086 <P>I have 2 queries:<BR /> |tstats values(sth.sth) as sth... |stats count by sth | ...</P> <P>and </P> <P>|tstats count from datamodel=sth ... | stats count by sth |...</P> <P>both give me a different event count. Just want to know why that is the case.</P> Mon, 03 Dec 2018 03:12:07 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-quot-tstats-count-quot-and-quot-tstats-values-quot/m-p/417339#M120086 eugenezxq 2018-12-03T03:12:07Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-quot-tstats-count-quot-and-quot-tstats-values-quot/m-p/417340#M120087 <P><EM>count(X)</EM><BR /><BR /> This function returns the number of occurrences of the field X. </P> <P><EM>values(X)</EM> <BR /> This function returns the list of all distinct values of the field X as a multi-value entry. The order of the values is lexicographical.</P> <P>this is from stats command page.. this will be applicable for tstats as well, i think<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions</A></P> <P><EM>As you are a new user to Splunk Answers, you can upvote the answers/comments, <BR /> if this answer resolved your query, you can select this answer and "accept" it as the answer, so that this question will be moved to answered queue. Happy Splunking!</EM></P> Mon, 03 Dec 2018 05:21:06 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-quot-tstats-count-quot-and-quot-tstats-values-quot/m-p/417340#M120087 inventsekar 2018-12-03T05:21:06Z