Splunk Search

Different Count for Events over a specified 15 min period

pitt93
New Member

I am trying to get a understanding why I get a different count total for the number of events for the following searches

1. index=some_specific_index  (Returns the following  total for events 7,601,134)

2. | tstats count where index=some_specific_index (Returns 7,593,248)

 

I do have the same date and time range sent when I run the query.

I understand why tstats and stats have different values.

 

 

 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

In a general case, both

index=whatever | stats count

and

| tstats count where index=whatever

run over a static period of time in the past should give you the same result.

If there is a difference it might mean that you're still ingesting data into that period of time so subsequent runs of either of those commands will yield different results.

But if you have a repeatable two different static values of those searches it might signal bucket corruption.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...