Can you help me with a query with the timechart command?

[mlorrette]

same search: timespan showing X results while search is showing Y results for the same timeframe.

This search that is part of a dashboard shows events on a Last 30 Days timeframe:

index=application "login.categories{}"="User Failed Login" | dedup user | timechart count span=1d

It returns 80 events for a particular date.
When I open the visualization in the search, I still see a count of 80 events for that one date.

However, when I zoom in on that day, through View Events or Narrow to This Timeframe, 130 events come up. Expanding the |timechart search for the last 3 months, now shows 50 events on that one specific date! The only thing I'm changing is the timeframe.

What's going on with timechart? Using Splunk 6.5.2.

[briancronrath · Accepted solution]

It's because you are deduping. It is expected that if you zoom out further, you'll get less users on that time frame because it will have most likely had duplicates in other timeframes (and they will get tallied only once over the entire timeframe). Similarly if you zoom in you'll get more results in the time frame because the deduping is more focused to a shorter timeframe.

Are you looking to dedup based on specific buckets of time? For instance, are you wanting to dedup in regards to just each day worth of logins? If so, dedup won't be the command you want, you'd be better off doing a

[...] | timechart dc(user) span=1d

[woodcock]

I was getting ready to type the same thing!

[mlorrette]

This is working perfectly. In a hindsight, it's "obvious" because the | dedup part comes before the timechart piece. Very heplful. Thank you.