Why is the dashboard result different in production and acceptance environment?

[patmarton]

Hello Splunkers,

I created a dashboard in splunk which is working fine based on our tests. When I moved it to production environment it shows false data. After going through the logs i found out that the exact same code shows duplicated values in the production environment.

I noticed that the code is fine, but after the following command, it shows duplicated values :

| stats list(RunTime) AS Run , avg(seconds) AS Average by SiteName, Country, SiteRegion

So the result before this line is:

**SiteName**  **RunTime**

Prague         10.9
Prague         10.2
Prague         19.8

And the result after that line is:

**SiteName**  **RunTime**

Prague         10.9
Prague         10.9
Prague         10.9
Prague         10.9
Prague         19.8
Prague         19.8
Prague         19.8
Prague         19.8

And so on.

I cannot really figure out why it happens, and also looking for a better solution than the dedup command.

Thank you.

[kmaron]

if you use values instead of list it will remove duplicates.

[patmarton]

Thank you for your answer. I do not really want to remove duplicates directly because there might be cases where the processing time is the same for different runs.

[kmaron]

Then what is it you're really aiming for?

[patmarton]

I need to know why data gets duplicated after that command. I can use dedup or values but in case there were two different runs with the same RunTime, I would lose one of them, and I only want to get rid of the duplicates.