Splunk Search

Count is incorrect

TitanAE
New Member

Trying to write a simple query in Splunk 7.0. The idea is that it would count all the unique ip addresses based on a specific location. So my query would look like this:

splunk index="some index" sourcetype="some sourcetype" earliest=-24h
stats count(ip) by location

After 100 rows, and (by my eyes) at least 12 unique addresses... it counts 5. So instead of:

  • location a ... 6
  • location b ... 10
  • location c ... 5

I get

  • location x ... 5

What gives?

Tags (2)
0 Karma

to4kawa
Ultra Champion
index="some index" sourcetype="some sourcetype" earliest=-24h
|stats count(ip) as ip_count dc(ip) as unique_ip_count by location

hi, @TitanAE
please provide your output details.

0 Karma

TitanAE
New Member

Okay... apparently verbose search really is slowing down my search.

0 Karma
Get Updates on the Splunk Community!

Upcoming Community Maintenance: 10/28

Howdy folks, just popping in to let you know that the Splunk Community site will be in read-only mode ...

Best Practices for Metrics Pipeline Management

We can’t guarantee the health of our services or a great user experience without data from our applications. ...

New Case Study: How LSU’s Student-Powered SOCs and Splunk Are Shaping the Future of ...

Louisiana State University (LSU) is shaping the next generation of cybersecurity professionals through its ...