topic Re: Difference between chart command with specified aggregated fields and without in Splunk Search

Difference between chart command with specified aggregated fields and without?

calm27 — Thu, 16 Mar 2023 15:36:50 GMT

I have two different queries that return the absolute same result:

value | chart count(status) by request_method, http_cloudid

and

value | chart count by request_method, http_cloudid

Does it mean that the field specified in the `count` function actually does nothing using `chart`?

bowesmana — Wed, 15 Mar 2023 22:50:47 GMT

Using count(field) means that it will count the number of events with the field status.

Using count on its own will just count all events, so if all events have a status field, it's the same thing.

If you have some events that do NOT have a status field, then they will give different results, it is not a function of using chart at all.