Splunk Search

Timechart count with split-by not adding up

asetyyli
Explorer

I have 191 events logged for a specific day.

When I do a

timechart span=1d count

I get count of 191 for that day as expected. But when trying to get a count of events split by a field

timechart span=1d count by userclass

the sum of columns generated according to the userclass add up to 194 (I have three userclasses, 100+26+68 = 194).

Is this a bug or am I missing something how the split-by clause works?

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Do any events have multiple userclass values?

Here's a dummy example:

| stats count | eval userclass = "foo bar baz" | makemv userclass | stats count by userclass

This generates one event with three userclass values, giving you a total of three after the final stats.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Do any events have multiple userclass values?

Here's a dummy example:

| stats count | eval userclass = "foo bar baz" | makemv userclass | stats count by userclass

This generates one event with three userclass values, giving you a total of three after the final stats.

martin_mueller
SplunkTrust
SplunkTrust

Done and done.

0 Karma

asetyyli
Explorer

Yes, some of the userclass field values were multivalues by mistake. Thanks for the tip! Can you make an answer out of your comment, so I can accept it?

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...