Knowledge Management

collect command - count value changing with time.

arjit
Path Finder

Hi All, 

I have created a scheduled reports (its not accelerated or summary indexed) and event count is populated into another index via collect command: 

index=xxxx host=yyyyy| stats count
| addinfo
| eval _time = info_min_time
| collect index=xyz_summary sourcetype="Trip Plans Other Apps" addTime=T

please note:

- the indexname contains summary but this index is not a summary index. 

- Report runs at morning 7 o'clock for the previous day's data and the _time is overwritten to previous date. This is done so that the count is logged in as previous day's data.  

The issue which we are facing here is when we run the same query for that time period after a few days( say a month), we are observing the value inside the index=xyz_summary (i.e. count value) is greater than when we run the original query. Interestingly, the results were both the same, when I ran both queries initially a month before.  

Any suggestions why is this happening (is it due to collect command) ? what modification can be done so that we dont get a mismatch here.    

Thanks in advance. 

Kind regards

AG. 

 

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...