https://community.splunk.com/t5/Splunk-Search/Count-is-incorrect/m-p/488324#M136424 <P>Trying to write a simple query in Splunk 7.0. The idea is that it would count all the unique ip addresses based on a specific location. So my query would look like this:</P> <PRE><CODE>splunk index="some index" sourcetype="some sourcetype" earliest=-24h stats count(ip) by location </CODE></PRE> <P>After 100 rows, and (by my eyes) at least 12 unique addresses... it counts 5. So instead of:</P> <UL> <LI>location a ... 6</LI> <LI>location b ... 10</LI> <LI>location c ... 5</LI> </UL> <P>I get</P> <UL> <LI>location x ... 5</LI> </UL> <P>What gives?</P> Fri, 17 Jan 2020 02:18:46 GMT TitanAE 2020-01-17T02:18:46Z https://community.splunk.com/t5/Splunk-Search/Count-is-incorrect/m-p/488324#M136424 <P>Trying to write a simple query in Splunk 7.0. The idea is that it would count all the unique ip addresses based on a specific location. So my query would look like this:</P> <PRE><CODE>splunk index="some index" sourcetype="some sourcetype" earliest=-24h stats count(ip) by location </CODE></PRE> <P>After 100 rows, and (by my eyes) at least 12 unique addresses... it counts 5. So instead of:</P> <UL> <LI>location a ... 6</LI> <LI>location b ... 10</LI> <LI>location c ... 5</LI> </UL> <P>I get</P> <UL> <LI>location x ... 5</LI> </UL> <P>What gives?</P> Fri, 17 Jan 2020 02:18:46 GMT https://community.splunk.com/t5/Splunk-Search/Count-is-incorrect/m-p/488324#M136424 TitanAE 2020-01-17T02:18:46Z https://community.splunk.com/t5/Splunk-Search/Count-is-incorrect/m-p/488325#M136425 <P>Okay... apparently verbose search really is slowing down my search.</P> Fri, 17 Jan 2020 02:41:12 GMT https://community.splunk.com/t5/Splunk-Search/Count-is-incorrect/m-p/488325#M136425 TitanAE 2020-01-17T02:41:12Z https://community.splunk.com/t5/Splunk-Search/Count-is-incorrect/m-p/488326#M136426 <PRE><CODE>index="some index" sourcetype="some sourcetype" earliest=-24h |stats count(ip) as ip_count dc(ip) as unique_ip_count by location </CODE></PRE> <P>hi, @TitanAE<BR /> please provide your output details.</P> Fri, 17 Jan 2020 03:05:23 GMT https://community.splunk.com/t5/Splunk-Search/Count-is-incorrect/m-p/488326#M136426 to4kawa 2020-01-17T03:05:23Z