https://community.splunk.com/t5/Splunk-Search/Why-does-count-and-dc-behave-differently/m-p/470612#M132384 <P><CODE>dc</CODE> is Distinct Count. It says how many unique values of the given field(s) exist. Since you did not supply a field name, it counted all fields and grouped them by the status field values.</P> <P>Had you used <CODE>dc(status)</CODE> the result should have been <CODE>7</CODE>.</P> <P><CODE>count</CODE> and <CODE>dc</CODE> generally are not interchangeable.</P> Mon, 30 Dec 2019 19:51:51 GMT richgalloway 2019-12-30T19:51:51Z https://community.splunk.com/t5/Splunk-Search/Why-does-count-and-dc-behave-differently/m-p/470611#M132383 <P>I have written the query</P> <PRE><CODE>index="main" host="web_application" | stats count by status </CODE></PRE> <P>The result is: </P> <P><STRONG>status count<BR /> 200 233056<BR /> 400 4156<BR /> 403 1658<BR /> 404 3652<BR /> 406 4184<BR /> 408 4142<BR /> 500 4088</STRONG></P> <P>I am happy with this. But when I use dc for the same, </P> <PRE><CODE>index="main" host="web_application" | stats dc by status </CODE></PRE> <P>I get:</P> <P><STRONG>status dc(JSESSIONID) dc(action) dc(bytes) dc(categoryId) dc(clientip) dc(date_hour) dc(date_mday) dc(date_minute) dc(date_month) dc(date_second) dc(date_wday) dc(date_year) dc(date_zone) dc(detail) dc(file) dc(host) dc(ident) dc(index) dc(items) dc(linecount) dc(method) dc(msg) dc(other) dc(password) dc(pg) dc(productId) dc(punct) dc(q) dc(referer) dc(referer_domain) dc(req_time) dc(root) dc(source) dc(sourcetype) dc(splunk_server) dc(start) dc(t) dc(timeendpos) dc(timestartpos) dc(uri) dc(uri_path) dc(uri_query) dc(user) dc(useragent) dc(version)<BR /> 200 11192 5 3802 7 183 24 30 60 2 60 7 1 1 1 10 1 1 1 0 1 2 5 902 1 9 16 105 1 110 5 106359 2 1 1 1 1 0 7 7 95883 12 95879 1 26 1<BR /> 400 1837 5 1595 1 182 24 30 60 2 60 7 1 1 0 5 1 1 1 0 1 2 0 794 0 0 2 80 0 13 4 2078 0 1 1 1 0 0 7 7 2021 5 2021 1 26 1<BR /> 403 670 5 657 1 178 24 30 60 2 60 7 1 1 2 6 1 1 1 0 1 2 0 536 0 0 1 70 0 15 4 826 1 1 1 1 0 0 7 7 713 6 712 1 26 1<BR /> 404 1624 5 1471 1 183 24 30 60 2 60 7 1 1 0 21 1 1 1 1 1 2 0 793 0 0 2 87 0 16 4 1826 7 1 1 1 0 1 7 7 1803 26 1743 1 26 1<BR /> 406 1850 5 1635 1 182 24 30 60 2 60 7 1 1 0 5 1</STRONG></P> <P>Why is this? What is that I am missing? <BR /> It may be a dumb question but. </P> Wed, 30 Sep 2020 03:27:20 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-count-and-dc-behave-differently/m-p/470611#M132383 palisetty 2020-09-30T03:27:20Z https://community.splunk.com/t5/Splunk-Search/Why-does-count-and-dc-behave-differently/m-p/470612#M132384 <P><CODE>dc</CODE> is Distinct Count. It says how many unique values of the given field(s) exist. Since you did not supply a field name, it counted all fields and grouped them by the status field values.</P> <P>Had you used <CODE>dc(status)</CODE> the result should have been <CODE>7</CODE>.</P> <P><CODE>count</CODE> and <CODE>dc</CODE> generally are not interchangeable.</P> Mon, 30 Dec 2019 19:51:51 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-count-and-dc-behave-differently/m-p/470612#M132384 richgalloway 2019-12-30T19:51:51Z