Splunk Search

Timechart count with split-by not adding up

asetyyli
Explorer

I have 191 events logged for a specific day.

When I do a

timechart span=1d count

I get count of 191 for that day as expected. But when trying to get a count of events split by a field

timechart span=1d count by userclass

the sum of columns generated according to the userclass add up to 194 (I have three userclasses, 100+26+68 = 194).

Is this a bug or am I missing something how the split-by clause works?

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Do any events have multiple userclass values?

Here's a dummy example:

| stats count | eval userclass = "foo bar baz" | makemv userclass | stats count by userclass

This generates one event with three userclass values, giving you a total of three after the final stats.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Do any events have multiple userclass values?

Here's a dummy example:

| stats count | eval userclass = "foo bar baz" | makemv userclass | stats count by userclass

This generates one event with three userclass values, giving you a total of three after the final stats.

martin_mueller
SplunkTrust
SplunkTrust

Done and done.

0 Karma

asetyyli
Explorer

Yes, some of the userclass field values were multivalues by mistake. Thanks for the tip! Can you make an answer out of your comment, so I can accept it?

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...