topic Re: why i am finding count difference in timechart function in Splunk Search

why i am finding count difference in timechart function

umsundar2015 — Thu, 12 Oct 2017 09:23:15 GMT

Hi,

When i run a search for 7 days , i am getting correct count for all 7 days .But when i run for 30 days then i am finding difference in count .I am left joining 2 indexes and finally i am using timechart command.
Please can anyone help me out

thanks,

Re: why i am finding count difference in timechart function

DalJeanis — Thu, 12 Oct 2017 13:05:01 GMT

Please post the search, with any confidential information removed, so we can help you more accurately.

Re: why i am finding count difference in timechart function

cmerriman — Thu, 12 Oct 2017 13:17:05 GMT

i believe it is the way that timechart buckets the days. I believe buckets start from the earliest date in your time frame.

If you search |timechart span=7d count for Last 30 days (2017-09-12 through 2017-10-12), the _time comes back with 2017-09-12, 2017-09-19, 2017-09-26, 2017-10-03 and 2017-10-10
however if you run the same search for Last 7 days (2017-10-05 through 2017-10-12), you'll get _time of 2017-10-05 and 2017-10-12

Re: why i am finding count difference in timechart function

umsundar2015 — Fri, 13 Oct 2017 08:08:22 GMT

Hi daljeanis,

This is my search,

Re: why i am finding count difference in timechart function

umsundar2015 — Fri, 13 Oct 2017 08:09:02 GMT

i am giving span=1d , Can you please help me out

Re: why i am finding count difference in timechart function

gcusello — Fri, 13 Oct 2017 08:32:13 GMT

Hi umsundar2015,
you used a join using IP as key, but in your subsearch you haven't IP field as output, so your join never matches.
Try to insert in your subsearch IP AS value or key stats.

Bye.
Giuseppe

Re: why i am finding count difference in timechart function

cmerriman — Tue, 29 Sep 2020 16:14:49 GMT

@Anonymous points out that IP is not in your subsearch, yet you have it set as the field to join to. Try

| join type=left IP 
    [ search index=rranges 
    | stats count by IP sas _time]

also, your whole query isn't by _time, so the total sum wouldn't match because you're summing by sas, not by day (_time span=1d). essentially, the bin command is not doing anything in the grand scheme.

if you wanted it by day and sas, bin _time first, then apply the stats command.

|bin span=1d _time
|stats count by sas _time