Splunk Search

Inconsistent Count result

kcchu01
Explorer

Original Search

sourcetype=xxx | dedup user | timechart span=1d count(user)

I found that the results are different for selecting the different time ranges

Time Range _time count(user)
All time : 2019-10-20 269
during Oct 20: 2019-10-20 1473

Why I got different results by selecting different time ranges?

Thank you

Tags (1)
0 Karma

wmyersas
Builder

Part of the issue with this search is you're using dedup in your original search ( sourcetype=xxx | dedup user | timechart span=1d count(user) )

A better search is this:

index=ndx sourcetype=srctp user=*
| timechart span=1d dc(user)

This will give you a distinct count of the user field per day using the much simpler (and faster) dc() ( distinct_count() ) stats function - https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Aggregatefunctions#distinct_count...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,
dedup has a limit of 10,000 results, if you want to exceed this limit you have to insert 0 in dedup command.
Something like this:

sourcetype=xxx 
| dedup 0 user 
| timechart span=1d count(user)

P.S.: It's better to always use index in main search to have more performant searches.

Ciao.
Giuseppe

0 Karma

wmyersas
Builder

It's also better to use stats vs dedup

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...