Splunk Search

Why are different search panels returning inconsistent results?

jdepp
Path Finder

I have a timeline panel that gives the count of the different message types for the last 7 days. Another panel provides the unique count of one type of message over 7 days. The third type is supposed to show the number of messages that have duplicates and this should be as simple as the difference between the two panels for one type of message. i.e

Total Message A - Unique Count Message A = Duplicate Count Message A

However no matter how I have reconstructed the searches and panel, I cannot get the numbers to coincide. I have got fantastic help from people on this forum with the searches but just want to perhaps understand why there is a difference and if there is a fix.

eg.

Panel 1 (different types counts)

sourcetype="logs.stats" | timechart count by message_type | fields _time Log Report Thread

for example yesterdays count for Log = 1947075

Panel 2 (unique count for type message Log)

source="/logs.stats/tcp/10057" message_type="Log"|  timechart dc(log_id)

for example yesterdays unique count = 856790

Panel 3 (duplicate count for type message Log)

source="/logs.stats/tcp/10057" message_type="Log" | bucket _time span=day 
 | stats count(log_id) as totalCount by _time
 | appendcols [ search 
    source="/logs.stats/tcp/10057" message_type="Log" 
    | bucket _time span=day 
    | eventstats dc(Log_id) as uniquetotal | eventstats count as duplicates by log_id| stats count(eval(duplicates=1)) as duplicates values(uniquetotal) as uniquetotal
    ]                          
 | eval dupCount = totalCount-uniquetotal
 | table totalCount dupCount uniquetotal

These totals = totalCount =3894252 ; dupCount =3565952 ; uniquetotal= 328300 ;

As you can see the numbers are complete off. Any ideas appreciated

0 Karma

gokadroid
Motivator

Is capitalization messing it up, if this is your exact query.. stats count( log_id ) as totalCount vs. eventstats dc( Log_id ) as uniquetotal??

0 Karma

jdepp
Path Finder

sorry that was just a type-o copy and paste

0 Karma

somesoni2
Revered Legend

In the third search, the uniquetotal field is calculated for whole period, not per day, how would it be comparable with total count per day query? Should you be comparing both counts on day-by-day basis like this?

source="/logs.stats/tcp/10057" message_type="Log"  | timechart span=1d count(log_id) as totalCount dc(log_id) as uniquetotal  | eval dupCount = totalCount-uniquetotal
  | table _time totalCount dupCount uniquetotal
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...