Splunk Search

Count is incorrect

New Member

Trying to write a simple query in Splunk 7.0. The idea is that it would count all the unique ip addresses based on a specific location. So my query would look like this:

splunk index="some index" sourcetype="some sourcetype" earliest=-24h
stats count(ip) by location

After 100 rows, and (by my eyes) at least 12 unique addresses... it counts 5. So instead of:

  • location a ... 6
  • location b ... 10
  • location c ... 5

I get

  • location x ... 5

What gives?

Tags (2)
0 Karma

Ultra Champion
index="some index" sourcetype="some sourcetype" earliest=-24h
|stats count(ip) as ip_count dc(ip) as unique_ip_count by location

hi, @TitanAE
please provide your output details.

0 Karma

New Member

Okay... apparently verbose search really is slowing down my search.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...