Original Search
sourcetype=xxx | dedup user | timechart span=1d count(user)
I found that the results are different for selecting the different time ranges
Time Range _time count(user)
All time : 2019-10-20 269
during Oct 20: 2019-10-20 1473
Why I got different results by selecting different time ranges?
Thank you
Part of the issue with this search is you're using dedup
in your original search ( sourcetype=xxx | dedup user | timechart span=1d count(user)
)
A better search is this:
index=ndx sourcetype=srctp user=*
| timechart span=1d dc(user)
This will give you a distinct count of the user
field per day using the much simpler (and faster) dc()
( distinct_count()
) stats function - https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Aggregatefunctions#distinct_count...
Hi @kcchu01,
dedup has a limit of 10,000 results, if you want to exceed this limit you have to insert 0 in dedup command.
Something like this:
sourcetype=xxx
| dedup 0 user
| timechart span=1d count(user)
P.S.: It's better to always use index in main search to have more performant searches.
Ciao.
Giuseppe
It's also better to use stats
vs dedup