Inconsistent results when searching using dedup sortby -_time

[dstark75]

I'm monitoring log files and want to generate reports using the most recent event types

I'm seeing an inconsistent number of results when I run a search:

index="myindex" source="/var/log/mysource" | dedup name sortby -_time | eventstats sum(passed) AS totalpassed | eventstats sum(failures) AS totalfailures | table totalpassed,totalfailures | head 1

I think my problem is the dedup statement, but can't figure out how. I tried different time intervals, but since these checks are run every minutes, I should be seeing the same results each search using the last 15 minutes.

[hortonew]

If you think the dedup is off, try verifying that you have the same number of users over a period of 15m time blocks

 index="myindex" source="/var/log/mysource" | timechart dc(name) span=15m