Hello all,
Running the following search (direct count) at different times of the day for the same time period I receive different results;
sourcetype=x index=y access_method="Explicit Proxy"
| table app,category,activity,user
| dedup user
| stats dc(user) by app
I can use this search but also get different results for the same time period, last 90 days;
sourcetype=x index=y access_method="Explicit Proxy"
| table app,category,activity,user
| dedup user
| stats count by app
Results look like this;
| App | dc(user) |
| app 1 | 499 |
| app2 | 36 |
| app3 | 19 |
Any suggestions on what maybe my issue?
Thanks
