Different search results quetion

johefu — Thu, 20 May 2021 19:07:35 GMT

Hello all,

Running the following search (direct count) at different times of the day for the same time period I receive different results;

sourcetype=x index=y access_method="Explicit Proxy"
| table app,category,activity,user
| dedup user
| stats dc(user) by app

I can use this search but also get different results for the same time period, last 90 days;

sourcetype=x index=y access_method="Explicit Proxy"
| table app,category,activity,user
| dedup user
| stats count by app

Results look like this;

Any suggestions on what maybe my issue?

Thanks

Re: Different search results quetion

ITWhisperer — Thu, 20 May 2021 18:50:46 GMT

What time periods are you using, earliest and latest?

johefu — Thu, 20 May 2021 19:05:15 GMT

I am using the date range, 2/1