Getting Data In

Why my stats command return wrong values ?

mah
Builder

Hi, 

I have a search very simple but it returns wrong results :

mah_0-1603900821689.png

The problem is the result is incoherent because the number of event is :

mah_2-1603901067229.png

Total of OK and KO not exceed 100

mah_3-1603901102927.png

Can you help me please ?

Tags (1)
0 Karma
1 Solution

mah
Builder

Yes, It is as I said : all values in all fields was twice. 

So I added on the search head an app with the sourcetype "B" with le parameter KV_MODE = none :

[B]

KV_MODE = none

and all values appear one time only :

mah_2-1603979247091.png

 

And finally my beginning query works well !

Thank you for your help. 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does State exist multiple times in any of the events so that when it is extracted you end up with a multi-value field such that 77% have OK in one of the values in the State field and 56% have KO in one of the values in the State field? Also, where you are counting State==OK and State==KO, perhaps this is counting where these are the only values of State in these events, i.e. the difference represents the number of events that have both values (OK and KO) in the multi-value field State?

0 Karma

Marco
Communicator

Try doing this:

eval OK=if(like(State,"OK"),1,0), KO=if(like(State,"KO"),1,0)| stats sum(OK) sum(KO)

 

Let me know if that work.

-Marco

0 Karma

mah
Builder

Yes, It is as I said : all values in all fields was twice. 

So I added on the search head an app with the sourcetype "B" with le parameter KV_MODE = none :

[B]

KV_MODE = none

and all values appear one time only :

mah_2-1603979247091.png

 

And finally my beginning query works well !

Thank you for your help. 

0 Karma

mah
Builder

@Marco 

I change eval if by eval case in the search :

mah_0-1603903808150.png

it gives : 

mah_3-1603904189896.png

mah_1-1603903889243.png

BUT my beginning query did the job for counting OK and KO BUT not for total. The result  is nonsense: 

mah_0-1603904979968.png

And more amazing, when I want to add fields after the by the count increase : 

mah_1-1603905188643.png

more fields after the by I add, more the count increase ! 

 
 

@ITWhisperer 

State is a unique field in one event and containing 2 values : OK and KO

 

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...