I'm having a problem with the following simple search in Splunk 6.3.3:
index=myIndex sourcetype=mySourcetype earliest="03/09/2016:08:00:00" latest="03/09/2016:18:00:00" | eval time=strftime(_time,"%H:%M") | eval day=strftime(_time,"%d/%m/%Y") | stats first(verso) as FirstVerso first(time) as FirstTime by day,badge_id | where FirstVerso=1 | stats count as "Users In"
All events have the badge_id and verso fields
If i run it in Verbose Mode, I get 80 results: running the same search in Fast Mode I get 240 results. The problem is with the "where FirstVerso=1" condition: if I omit this check, I get always the same number of results (325) both in Verbose and Fast mode.