Splunk Search

Count is incorrect

TitanAE
New Member

Trying to write a simple query in Splunk 7.0. The idea is that it would count all the unique ip addresses based on a specific location. So my query would look like this:

splunk index="some index" sourcetype="some sourcetype" earliest=-24h
stats count(ip) by location

After 100 rows, and (by my eyes) at least 12 unique addresses... it counts 5. So instead of:

  • location a ... 6
  • location b ... 10
  • location c ... 5

I get

  • location x ... 5

What gives?

Tags (2)
0 Karma

to4kawa
Ultra Champion
index="some index" sourcetype="some sourcetype" earliest=-24h
|stats count(ip) as ip_count dc(ip) as unique_ip_count by location

hi, @TitanAE
please provide your output details.

0 Karma

TitanAE
New Member

Okay... apparently verbose search really is slowing down my search.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...