topic Re: Inconsistent Count result in Splunk Search

Inconsistent Count result

kcchu01 — Fri, 22 Nov 2019 07:59:41 GMT

Original Search

sourcetype=xxx | dedup user | timechart span=1d count(user)

I found that the results are different for selecting the different time ranges

Time Range _time count(user)
All time : 2019-10-20 269
during Oct 20: 2019-10-20 1473

Why I got different results by selecting different time ranges?

Thank you

gcusello — Fri, 22 Nov 2019 09:25:39 GMT

Hi @kcchu01,
dedup has a limit of 10,000 results, if you want to exceed this limit you have to insert 0 in dedup command.
Something like this:

sourcetype=xxx 
| dedup 0 user 
| timechart span=1d count(user)

P.S.: It's better to always use index in main search to have more performant searches.

Ciao.
Giuseppe

wmyersas — Fri, 22 Nov 2019 14:25:14 GMT

It's also better to use stats vs dedup

wmyersas — Fri, 22 Nov 2019 14:28:04 GMT

Part of the issue with this search is you're using dedup in your original search ( sourcetype=xxx | dedup user | timechart span=1d count(user) )

A better search is this:

index=ndx sourcetype=srctp user=*
| timechart span=1d dc(user)

This will give you a distinct count of the user field per day using the much simpler (and faster) dc() ( distinct_count() ) stats function - https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Aggregatefunctions#distinct_count.28X.29_or_dc.28X.29