topic Re: Splunk return different event count in verbose vs fast mode using "where" in Splunk Search

Splunk return different event count in verbose vs fast mode using "where"

marcoscala — Thu, 17 Mar 2016 14:22:43 GMT

Hi!
I'm having a problem with the following simple search in Splunk 6.3.3:

index=myIndex sourcetype=mySourcetype earliest="03/09/2016:08:00:00" latest="03/09/2016:18:00:00" 
| eval time=strftime(_time,"%H:%M") | eval day=strftime(_time,"%d/%m/%Y")  
| stats first(verso) as FirstVerso first(time) as FirstTime by day,badge_id  
| where FirstVerso=1 | stats count as "Users In"

All events have the badge_id and verso fields
If i run it in Verbose Mode, I get 80 results: running the same search in Fast Mode I get 240 results. The problem is with the "where FirstVerso=1" condition: if I omit this check, I get always the same number of results (325) both in Verbose and Fast mode.

Suggestions?!?!

Regards,

Re: Splunk return different event count in verbose vs fast mode using "where"

somesoni2 — Thu, 17 Mar 2016 14:44:00 GMT

Are the field verso an custom extracted field OR is it automatically extracted by Splunk?

Re: Splunk return different event count in verbose vs fast mode using "where"

marcoscala — Thu, 17 Mar 2016 15:49:18 GMT

Hi!
No, there's a field extraction to extract those fields using a REPORT commando in props.conf.

Re: Splunk return different event count in verbose vs fast mode using "where"

Runals — Thu, 17 Mar 2016 18:06:11 GMT

For S&Gs try adjusting your initial search to

index=myIndex sourcetype=mySourcetype earliest="03/09/2016:08:00:00" latest="03/09/2016:18:00:00" day=* badge_id=* verso=*

Re: Splunk return different event count in verbose vs fast mode using "where"

marcoscala — Fri, 18 Mar 2016 07:53:08 GMT

Hi Runals,
I just try your suggestions, but I still get the same odd behaviour....

Re: Splunk return different event count in verbose vs fast mode using "where"

marcoscala — Fri, 18 Mar 2016 08:09:56 GMT

Here's a screenshot of my actual searches in Verbose and Fast mode.