Splunk Search

Timechart count with split-by not adding up

asetyyli
Explorer

I have 191 events logged for a specific day.

When I do a

timechart span=1d count

I get count of 191 for that day as expected. But when trying to get a count of events split by a field

timechart span=1d count by userclass

the sum of columns generated according to the userclass add up to 194 (I have three userclasses, 100+26+68 = 194).

Is this a bug or am I missing something how the split-by clause works?

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Do any events have multiple userclass values?

Here's a dummy example:

| stats count | eval userclass = "foo bar baz" | makemv userclass | stats count by userclass

This generates one event with three userclass values, giving you a total of three after the final stats.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Do any events have multiple userclass values?

Here's a dummy example:

| stats count | eval userclass = "foo bar baz" | makemv userclass | stats count by userclass

This generates one event with three userclass values, giving you a total of three after the final stats.

martin_mueller
SplunkTrust
SplunkTrust

Done and done.

0 Karma

asetyyli
Explorer

Yes, some of the userclass field values were multivalues by mistake. Thanks for the tip! Can you make an answer out of your comment, so I can accept it?

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...