What is the difference between Event Count and Statistic Count in Splunk search results?

sarfaraz1089 — Tue, 02 Sep 2014 16:12:30 GMT

In Splunk search results, what is the difference between events count and statistic count. (I am unable to upload the image of the search result as my karma scoreis less than 60.)

Re: What is the difference between Event Count and Statistic Count in Splunk search results?

strive — Tue, 02 Sep 2014 17:20:43 GMT

Upload the image to some third party website and provide the link.

I guess you are asking about the Events and Statistics tabs of Search Assistant. Assuming this, i will answer your question.

Re: What is the difference between Event Count and Statistic Count in Splunk search results?

strive — Tue, 02 Sep 2014 17:35:48 GMT

Events tab:

It displays the plain events present in the index.

For Example: Say you write a search as index=myindex earliest=-1d@d latest=-0d@d For this, the Events Tab lists all the events present in the index myindex for previous day.

Note: Here myindex can be a raw index or a summary index.

For the above search, the Statistics tab doesn't display any reporting data since you have not used any reporting commands. The Statistics tab will contain a message: "Your search isn't generating any statistic or visualization results. Here are some possible ways to get results."

Statistics tab:

This tab depicts search results as report result tables. For the same search that is used in the Events tab example, if we add some reporting search command, say for example: index=myindex earliest=-1d@d latest=-0d@d | stats count as Count by ClientIP then the Statistics tab contains data for this search with two columns ClientIP and Count.

Assume that your index has 1000 log events and the unique ClientIP count in those 1000 log lines is 10. Then the Events tab will contain 1000 entries and the tab heading will be Events(1000), the Statistics tab will contain 10 entries and the tab heading will be Statistics(10)

One more point is: whether data gets displayed under Events tab or not depends on the search mode.
For more details read this http://docs.splunk.com/Documentation/Splunk/6.1.3/Search/Changethesearchmode

topic Re: What is the difference between Event Count and Statistic Count in Splunk search results? in Splunk Search

What is the difference between Event Count and Statistic Count in Splunk search results?

Re: What is the difference between Event Count and Statistic Count in Splunk search results?

Re: What is the difference between Event Count and Statistic Count in Splunk search results?