Why am I getting different results using stats first() last() earliest() and latest() on _time in a report versus a dashboard?

[schose]

Hi all,

I having a strange issue using a stats search e.g.:

'collectd_index` object="df-*" (df_complex_used=* OR df_complex_free=* OR df_complex_reserved=*) | stats earliest(_time) as time_early latest(_time) as time_latest last(_time) as time_last first(_time) as time_first 
| fieldformat time_early=strftime(time_early,"%F %T") 
| fieldformat time_latest=strftime(time_latest,"%F %T") 
| fieldformat time_last=strftime(time_last,"%F %T") 
| fieldformat time_first=strftime(time_first,"%F %T")

When doing this in a search or report, i get the results:

"time_early","time_latest","time_last","time_first"
"2015-04-15 00:00:02","2015-04-16 23:59:51","**2015-04-15 00:00:02**","2015-04-16 23:59:51"

When using this search in a dashboard and using the exact same time frame (2015-04-15 00:00:02-2015-04-16 24:00:00) I'm getting the result:

"time_early","time_latest","time_last","time_first"
"2015-04-15 00:00:02","2015-04-16 23:59:51","**2015-04-16 16:33:17**","2015-04-16 23:59:51"

This issue only occurs between certain time frames and only in the dashboard! Using other timeframes in the dashboard like (2015-04-14 00:00:00-2015-04-15 24:00:00) is giving back expected results:

"time_early","time_latest","time_last","time_first"
"2015-04-14 00:00:02","2015-04-15 23:59:57","**2015-04-14 00:00:02**","2015-04-15 23:59:56"

For me it seems like there is an issue with the stats last(X) function or is there any good explanation for that?

Best regards,

Andreas

[woodcock]

What I find is that FREQUENTLY dashboard searches timeout before completing because there is too much going on at the same time (too many panels running searches at once). To test this, copy your panel to a dashboard that has ONLY that 1 panel. I suspect that it will complete and the results will match. Because "last" comes from the "last event processed", it makes sense that if the dashboard search was killed before it completed, it would have a date earlier than it should.

[Runals]

No clue but I tend to use min and max when working with the _time field as it is stored in epoch format. Not quite an answer to your question really.