Splunk Search

Inconsistent Count result

kcchu01
Explorer

Original Search

sourcetype=xxx | dedup user | timechart span=1d count(user)

I found that the results are different for selecting the different time ranges

Time Range _time count(user)
All time : 2019-10-20 269
during Oct 20: 2019-10-20 1473

Why I got different results by selecting different time ranges?

Thank you

Tags (1)
0 Karma

wmyersas
Builder

Part of the issue with this search is you're using dedup in your original search ( sourcetype=xxx | dedup user | timechart span=1d count(user) )

A better search is this:

index=ndx sourcetype=srctp user=*
| timechart span=1d dc(user)

This will give you a distinct count of the user field per day using the much simpler (and faster) dc() ( distinct_count() ) stats function - https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Aggregatefunctions#distinct_count...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,
dedup has a limit of 10,000 results, if you want to exceed this limit you have to insert 0 in dedup command.
Something like this:

sourcetype=xxx 
| dedup 0 user 
| timechart span=1d count(user)

P.S.: It's better to always use index in main search to have more performant searches.

Ciao.
Giuseppe

0 Karma

wmyersas
Builder

It's also better to use stats vs dedup

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...