topic Re: Why are different search panels returning inconsistent results? in Splunk Search

Why are different search panels returning inconsistent results?

jdepp — Sat, 21 Jan 2017 09:20:00 GMT

I have a timeline panel that gives the count of the different message types for the last 7 days. Another panel provides the unique count of one type of message over 7 days. The third type is supposed to show the number of messages that have duplicates and this should be as simple as the difference between the two panels for one type of message. i.e

Total Message A - Unique Count Message A = Duplicate Count Message A

However no matter how I have reconstructed the searches and panel, I cannot get the numbers to coincide. I have got fantastic help from people on this forum with the searches but just want to perhaps understand why there is a difference and if there is a fix.

eg.

Panel 1 (different types counts)

sourcetype="logs.stats" | timechart count by message_type | fields _time Log Report Thread

for example yesterdays count for Log = 1947075

Panel 2 (unique count for type message Log)

source="/logs.stats/tcp/10057" message_type="Log"|  timechart dc(log_id)

for example yesterdays unique count = 856790

Panel 3 (duplicate count for type message Log)

source="/logs.stats/tcp/10057" message_type="Log" | bucket _time span=day 
 | stats count(log_id) as totalCount by _time
 | appendcols [ search 
    source="/logs.stats/tcp/10057" message_type="Log" 
    | bucket _time span=day 
    | eventstats dc(Log_id) as uniquetotal | eventstats count as duplicates by log_id| stats count(eval(duplicates=1)) as duplicates values(uniquetotal) as uniquetotal
    ]                          
 | eval dupCount = totalCount-uniquetotal
 | table totalCount dupCount uniquetotal

These totals = totalCount =3894252 ; dupCount =3565952 ; uniquetotal= 328300 ;

As you can see the numbers are complete off. Any ideas appreciated

Re: Why are different search panels returning inconsistent results?

somesoni2 — Sat, 21 Jan 2017 20:50:55 GMT

In the third search, the uniquetotal field is calculated for whole period, not per day, how would it be comparable with total count per day query? Should you be comparing both counts on day-by-day basis like this?

source="/logs.stats/tcp/10057" message_type="Log"  | timechart span=1d count(log_id) as totalCount dc(log_id) as uniquetotal  | eval dupCount = totalCount-uniquetotal
  | table _time totalCount dupCount uniquetotal

Re: Why are different search panels returning inconsistent results?

gokadroid — Sat, 21 Jan 2017 21:12:52 GMT

Is capitalization messing it up, if this is your exact query.. stats count( log_id ) as totalCount vs. eventstats dc( Log_id ) as uniquetotal??

Re: Why are different search panels returning inconsistent results?

jdepp — Sun, 22 Jan 2017 11:18:40 GMT

sorry that was just a type-o copy and paste