How to retrieve the same result in 2 similar search with count different?

[jip31]

hi

In my dashboard, I use 2 similar searches

in the first, I am doing a dc of  "s"

index=test earliest=@d+7h latest=@d+19h
| search rtt >= 150
| stats count as Pb by s
| search Pb >= 5 
| stats dc(s)

the result is 12 

in the second search, i use the same search but I need to gather events also by "s" and also _time

index=test type=* earliest=@d+7h latest=@d+19h 
| bin span=1h _time  
| search rtt >= 150
| stats count as Pb by s _time 
| search Pb >= 5
| timechart dc(s) as sam span=1h 
| where _time < now() 
| eval time = strftime(_time, "%H:%M") 
| stats sum(s) as nbs by time 
| rename time as Heure

the pb I have is that the results is not equal to 12 but to 6

Why I can retrieve the same resulst that in the first search please?

[ITWhisperer]

The results are different because the first set of results is based on counts for the whole time period, whereas the second set of results is based on counts each hour.

[jip31]

ok, but....

why I can see 7 different values for the field "s" in the first search while in the second search i just see 4 different values for field "s"?

Normally, all the field "s" which exists in the first search must exist in the second search but dispatched following the hour no?

[ITWhisperer]

Because you are searching for Pb > 5

This removes some instances of s if their counts for that hour do not satisfy this criteria. It is what your search is asking for.

[jip31]

Ok i thing you are right even if it's not esay to visualize, 

so last thing could you confirm me that its normal that the result of distinct count done in the first search is different than when I aggregate the results of each bin _time of the second search?

[ITWhisperer · Accepted solution]

Yes, this is sounds like a perfectly understandable result based on what the searches do. Whether this is what you intended might be a different matter, but only you can be the judge of that 😁