Splunk Search

Splunk return different event count in verbose vs fast mode using "where"

marcoscala
Builder

Hi!
I'm having a problem with the following simple search in Splunk 6.3.3:

index=myIndex sourcetype=mySourcetype earliest="03/09/2016:08:00:00" latest="03/09/2016:18:00:00" 
| eval time=strftime(_time,"%H:%M") | eval day=strftime(_time,"%d/%m/%Y")  
| stats first(verso) as FirstVerso first(time) as FirstTime by day,badge_id  
| where FirstVerso=1 | stats count as "Users In"

All events have the badge_id and verso fields
If i run it in Verbose Mode, I get 80 results: running the same search in Fast Mode I get 240 results. The problem is with the "where FirstVerso=1" condition: if I omit this check, I get always the same number of results (325) both in Verbose and Fast mode.

Suggestions?!?!

Regards,

marcoscala
Builder

alt text

Here's a screenshot of my actual searches in Verbose and Fast mode.

0 Karma

Runals
Motivator

For S&Gs try adjusting your initial search to

index=myIndex sourcetype=mySourcetype earliest="03/09/2016:08:00:00" latest="03/09/2016:18:00:00" day=* badge_id=* verso=*
0 Karma

marcoscala
Builder

Hi Runals,
I just try your suggestions, but I still get the same odd behaviour....

0 Karma

somesoni2
Revered Legend

Are the field verso an custom extracted field OR is it automatically extracted by Splunk?

0 Karma

marcoscala
Builder

Hi!
No, there's a field extraction to extract those fields using a REPORT commando in props.conf.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...