https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-returning-a-different-set-of-results-after-I/m-p/160293#M45298 <P>Is it the same without the <CODE>fillnull</CODE> command?</P> Tue, 04 Aug 2015 13:35:59 GMT woodcock 2015-08-04T13:35:59Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-returning-a-different-set-of-results-after-I/m-p/160292#M45297 <P>Hi, </P> <P>I wonder whether someone may be able to help me please.</P> <P>I'm using the search below to successfully produce a given group of stats:</P> <PRE><CODE>auditSource=ts auditType=RenewalStarted NOT [search auditSource=ts auditType=RenewalCompleted | table detail.nino] | iplocation tags.clientIP |dedup detail.nino | fillnull value="Country Not Found" Country | stats count by Country </CODE></PRE> <P>Because I know that the <CODE>dedup</CODE> command can be resource intensive, I've tried changing this by using the <CODE>stats dc</CODE> command as below:</P> <PRE><CODE>auditSource=ts auditType=RenewalStarted NOT [search auditSource=ts auditType=RenewalCompleted | table detail.nino] | iplocation tags.clientIP | fillnull value="Country Not Found" Country | stats dc(detail.nino) By Country </CODE></PRE> <P>The problem I have is that although I'm using the same date period, the search is not returning the same set of results.</P> <P>I just wondered whether someone may be able to look at this please and offer some guidance on where I may have gone wrong.</P> <P>Many thanks and kind regards</P> <P>Chris</P> Tue, 04 Aug 2015 06:39:19 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-returning-a-different-set-of-results-after-I/m-p/160292#M45297 IRHM73 2015-08-04T06:39:19Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-returning-a-different-set-of-results-after-I/m-p/160293#M45298 <P>Is it the same without the <CODE>fillnull</CODE> command?</P> Tue, 04 Aug 2015 13:35:59 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-returning-a-different-set-of-results-after-I/m-p/160293#M45298 woodcock 2015-08-04T13:35:59Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-returning-a-different-set-of-results-after-I/m-p/160294#M45299 <P>Hi thank you for coming back to me. When I omit the fillnull from the second query the number of events are still greater than the initial query and the count significantly reduced.</P> <P>However If I changed the latter query to <CODE>auditSource=tc auditType=TCStarted NOT [search auditSource=tc auditType=TCCompleted | table detail.nino] | iplocation tags.clientIP | fillnull value="Country Not Found" | stats dc(detail.nino) By Country</CODE> which is now working perfectly.</P> <P>Kind regards</P> <P>Chris</P> Wed, 05 Aug 2015 06:28:01 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-returning-a-different-set-of-results-after-I/m-p/160294#M45299 IRHM73 2015-08-05T06:28:01Z