Getting Data In

Stricter search gives me more results...what?

rlough
Path Finder

I have a query that looks like this

index=*ind* ((source=*src1.log field=NAME) OR (source=*src1.log field=STRING)) | eventstats count(eval(field=="NAME")) AS f1 count(eval(field=="STRING")) AS f2 by users | where f1 < 1 AND f2 > 0 | dedup users | table users

The above returns something like 2000 statistics, but when I remove AND f2 > 0 and query along the exact same timeframe I get around 100 less statistics.

Why would making a search stricter ever return more results? This doesn't make sense.

Tags (2)
0 Karma
1 Solution

hortonew
Builder

I think it might be treating that as a single expression rather than two separate expressions.

Either try: where (f1 < 1) AND (f2 > 0)
or
where f1 < 1 | where f2 > 0

and see what the results look like

View solution in original post

hortonew
Builder

I think it might be treating that as a single expression rather than two separate expressions.

Either try: where (f1 < 1) AND (f2 > 0)
or
where f1 < 1 | where f2 > 0

and see what the results look like

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...