https://community.splunk.com/t5/Splunk-Search/Event-sampling-and-Count-accuracy/m-p/614874#M213682 <P>I have a need for approximate statistics/metrics and am currently using Event Sampling, which drastically speeds up the queries. For queries that calculate averages this works great, but I also have a need to do counts. If you set the Event Sampling to for example 1:100, then Splunk seems to look at every 100 Events, which is also reflected in how many Events that are matched when doing 1:100 vs 1:1.</P><P>Example count with and without sampling:</P><P>1:100 = 26311<BR />1:1 = 2623658<BR />1:100 scaled up to 1:1 = 2631100<BR />Diff = 7442, which is 0.3%</P><P>The Time Period was a previous hour (not the latest hour) as not to have incoming Events affect the Count.</P><P>0.3% difference is perfectly ok for my purpose.</P><P>&nbsp;</P><P>Am I thinking of this correctly, or is there any risk of much bigger differences in Count (after upscaling the count)?</P> Wed, 28 Sep 2022 06:59:06 GMT dmoberg 2022-09-28T06:59:06Z https://community.splunk.com/t5/Splunk-Search/Event-sampling-and-Count-accuracy/m-p/614874#M213682 <P>I have a need for approximate statistics/metrics and am currently using Event Sampling, which drastically speeds up the queries. For queries that calculate averages this works great, but I also have a need to do counts. If you set the Event Sampling to for example 1:100, then Splunk seems to look at every 100 Events, which is also reflected in how many Events that are matched when doing 1:100 vs 1:1.</P><P>Example count with and without sampling:</P><P>1:100 = 26311<BR />1:1 = 2623658<BR />1:100 scaled up to 1:1 = 2631100<BR />Diff = 7442, which is 0.3%</P><P>The Time Period was a previous hour (not the latest hour) as not to have incoming Events affect the Count.</P><P>0.3% difference is perfectly ok for my purpose.</P><P>&nbsp;</P><P>Am I thinking of this correctly, or is there any risk of much bigger differences in Count (after upscaling the count)?</P> Wed, 28 Sep 2022 06:59:06 GMT https://community.splunk.com/t5/Splunk-Search/Event-sampling-and-Count-accuracy/m-p/614874#M213682 dmoberg 2022-09-28T06:59:06Z https://community.splunk.com/t5/Splunk-Search/Event-sampling-and-Count-accuracy/m-p/615235#M213808 <P>I think you're correct, at least with regard to event counts.</P> Thu, 29 Sep 2022 15:23:36 GMT https://community.splunk.com/t5/Splunk-Search/Event-sampling-and-Count-accuracy/m-p/615235#M213808 richgalloway 2022-09-29T15:23:36Z