Hello,
We are using Splunk v8.2.5 (Build:77015bc7a462 if this helps).
Since we upgraded we no longer receive errors or warnings when stats, eventstats, or streamstats is not returning the correct values. We have a lookup csv of nearly 3 million records containing several fields that need to be counted and compared: prize code, address, email, etc.
The eventstats command fails and there is no error or warning. However, the stats command works. This would be okay if we had only one field to be counted. We have 4-8 fields that must be counted and compared. Using the stats command quickly becomes a nightmare because every field that is not being counted in relation to the particular field in the by clause would need to be added using values(FIELDNAME). The eventstats command would be cleaner.
Or would it?
| bin _time span=1d
| eventstats count(prize_code) as count_prize_code by _time, address
| dedup address, count_prize_code, _time
| eventstats count(_time) as count_prize_code_dates, sum(count_prize_code) as sum_count_prize_code by address
| dedup address, count_prize_code_dates, sum_count_prize_code
| table address, count_prize_code_dates, sum_count_prize_code
Thanks and God bless,
Genesius
