Getting Data In

Appendcols - Issue in the output of the query

vn_g
Path Finder

Query1 : index="*" earliest=-1mon@mon latest=@mon
| stats count

O/P : 25,419,925,723

Query2 : index="*" earliest=-2mon@mon latest=-1mon@mon
| stats count as Twomonthsbeforecount
| appendcols
[ search index="*" earliest=-1mon@mon latest=@mon
| stats count as Onemonthbeforecount ]
| eval Difference=Onemonthbeforecount-Twomonthsbeforecount
| table Difference Onemonthbeforecount Twomonthsbeforecount

O/P :

DifferenceOnemonthbeforecountTwomonthsbeforecount
-2654151775516952487526711042630

 

Query 1 output should match the Query 2 "Onemonthbeforecount " column value, but why is it differing? Am i missing out something to check?

Labels (1)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @vn_g,

Can you try with tstats?

| tstats count as Twomonthsbeforecount where index="*" earliest=-2mon@mon latest=-1mon@mon
| appendcols
[ tstats count as Onemonthbeforecount where index="*" earliest=-1mon@mon latest=@mon ]
| eval Difference=Onemonthbeforecount-Twomonthsbeforecount
| table Difference Onemonthbeforecount Twomonthsbeforecount
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @vn_g,

Can you try with tstats?

| tstats count as Twomonthsbeforecount where index="*" earliest=-2mon@mon latest=-1mon@mon
| appendcols
[ tstats count as Onemonthbeforecount where index="*" earliest=-1mon@mon latest=@mon ]
| eval Difference=Onemonthbeforecount-Twomonthsbeforecount
| table Difference Onemonthbeforecount Twomonthsbeforecount
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

vn_g
Path Finder

Yes, this helped. Thankyou so much

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is your subsearch getting truncated due to limits on subsearches?

0 Karma

vn_g
Path Finder

No I don’t see any DAG execution error 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...