topic Why Stats count command is counting events that are missing in other searches? in Splunk Search

Why Stats count command is counting events that are missing in other searches?

abhijeetallu — Tue, 12 Sep 2023 21:17:52 GMT

The first search query returns a count of 26 for domain X :

index="web" sourcetype="weblogic_stdout" loglevel IN ("Emergency") | stats count by domain

But when I run the below query to just see the events corresponding to domain=X, I get zero events:

index="web" sourcetype="weblogic_stdout" loglevel IN ("Emergency") domain="X"

Any clue why this might be happening

Re: Stats count command is counting events that are missing in other searches

bowesmana — Tue, 12 Sep 2023 04:25:17 GMT

That generally means X is not X, i.e. if you put

index="web" sourcetype="weblogic_stdout" loglevel IN ("Emergency") domain="*X*"

do you get results

If you do this in your first search

index="web" sourcetype="weblogic_stdout" loglevel IN ("Emergency") | eval trimmed_domain=trim(domain) | eval bounded_domain=":".domain.":" | stats count by domain trimmed_domain bounded_domain | eval trimmed_equal_domain=if(trimmed_domain=domain, "YES", "NO")

you may see whether you have leading or trailing spaces around X and if trimmed_equal_domain is NO, then there are leading/trailing spaces.

The bounded domain makes it easier to see what's what by adding : before and after

Re: Stats count command is counting events that are missing in other searches

abhijeetallu — Thu, 14 Sep 2023 16:46:32 GMT

Thank you so much ! it worked. I was clueless what was happening and all this time it was a trailing space character !