Splunk IT Service Intelligence

Why is eventstats causing incorrect values?

EricLloyd79
Builder

alt textI have the query seen in the screenshot and it seems if I use eventstats it returns an incorrect value far larger than it should be for my summation of the difference of two values. If I use stats instead of eventstats, it works as expected.
Can anyone give me any insight why eventstats would be doing this?
Ive attached a screenshot using stats and one with eventstats.

(I need to use eventstats as this is a query for ITSI)

alt text

0 Karma

Vijeta
Influencer

when you use - stats earliest() and latest by host, it is giving you one row per host with earliest and latest value of the fields you mentioned. If you use eventstats instead it will return you all the events from all the host with the earliest and latest value for that host added in each event. For example you have 4 hosts and each host has say 10 events then stats will result into 4 rows/events one for each host with the earliest and the latest value of the field mentioned. In case of eventstats it will give you all the 40 events, with the value of latest and earliest field in all the events based on the host. You should try running both the stats and eventstats command separately to see the difference. Also depending on your need you may need to use stats or eventstats or streamstats.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...