Returning incorrect count from Splunk stats command

[Ganesh1]

Hi Splunk team,
We have been using similar below Splunk query across 15+ Splunk alerts but the count mentioned in email shows 4 times of actual failure occurrence.

index="<your_index>" sourcetype="<your_sourcetype>" source="<your_source.log>" Business_App_ID=<your_appid> Object=* (Failure_Message=*0x01130006* OR Failure_Message=*0x01130009*) | stats count by Object, Failure_Message | sort count

Below Splunk query is returning correct failure events.

index="<your_index>" sourcetype="<your_sourcetype>" source="<your_source.log>" Business_App_ID=<your_appid> Object=* (Failure_Message=*0x01130006* OR Failure_Message=*0x01130009*)

Can you please help in updating the Splunk query(mentioned 1st) to show correct count instead wrong one?

[gcusello]

Hi @Ganesh1 ,

If the events are less than the total count in stats ,check i the fields Object and Failure_Message are present in all the events or only in a subset of them, and eventually not both in the same events.

If the events are freater than the total count in stats, probably you have more values in the same events.

because probably the issue is related to the fact that a stats count BY two fields returns the count of results with both the fields containing a value.

Ciao.

Giuseppe

[ITWhisperer]

There is insufficient information to be able to determine what might be amiss. For example, if your events have multi-value fields, this can give unexpected counts. Please share some representative anonymised examples of your events.