Inconsistent Count result

[kcchu01]

Original Search

sourcetype=xxx | dedup user | timechart span=1d count(user)

I found that the results are different for selecting the different time ranges

Time Range _time count(user)
All time : 2019-10-20 269
during Oct 20: 2019-10-20 1473

Why I got different results by selecting different time ranges?

Thank you

[wmyersas]

Part of the issue with this search is you're using dedup in your original search ( sourcetype=xxx | dedup user | timechart span=1d count(user) )

A better search is this:

index=ndx sourcetype=srctp user=*
| timechart span=1d dc(user)

This will give you a distinct count of the user field per day using the much simpler (and faster) dc() ( distinct_count() ) stats function - https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Aggregatefunctions#distinct_count...

[gcusello]

Hi @kcchu01,
dedup has a limit of 10,000 results, if you want to exceed this limit you have to insert 0 in dedup command.
Something like this:

sourcetype=xxx 
| dedup 0 user 
| timechart span=1d count(user)

P.S.: It's better to always use index in main search to have more performant searches.

Ciao.
Giuseppe

[wmyersas]

It's also better to use stats vs dedup