Archive

Why is the number of host values for the same time period different in tstats vs search on wineventlogs?

landen99
Motivator

I search the same time period in wineventlogs for host values with tstats (37,558) and with regular search (42,008):

| tstats count where index=wineventlog sourcetype=wineventlog
(TERM(LogName=Microsoft-Windows-PowerShell/Operational) OR TERM(SourceName=Microsoft-Windows-PowerShell))
(TERM(EventCode=4103) OR TERM(EventCode=4104) OR TERM(EventCode=4105) OR TERM(EventCode=4106)) by host

versus:

index=wineventlog sourcetype=wineventlog
(TERM(LogName=Microsoft-Windows-PowerShell/Operational) OR TERM(SourceName=Microsoft-Windows-PowerShell))
(TERM(EventCode=4103) OR TERM(EventCode=4104) OR TERM(EventCode=4105) OR TERM(EventCode=4106))
| stats count by host

The number of ComputerName values for the same time period is 41,656, which may be less simply due to the addition of new logs to the indexers for that time period before my searches above were run. Ironically, it took less time than my search on the indexed field "host" and I don't understand that either: 375s vs 430s, respectively.

Tags (1)

woodcock
Esteemed Legend

That is totally wrong. You should open a support case for sure.

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!