I'm monitoring log files and want to generate reports using the most recent event types
I'm seeing an inconsistent number of results when I run a search:
index="myindex" source="/var/log/mysource" | dedup name sortby -_time | eventstats sum(passed) AS totalpassed | eventstats sum(failures) AS totalfailures | table totalpassed,totalfailures | head 1
I think my problem is the dedup statement, but can't figure out how. I tried different time intervals, but since these checks are run every minutes, I should be seeing the same results each search using the last 15 minutes.
If you think the dedup is off, try verifying that you have the same number of users over a period of 15m time blocks
index="myindex" source="/var/log/mysource" | timechart dc(name) span=15m