Splunk Search

Why are different search panels returning inconsistent results?

jdepp
Path Finder

I have a timeline panel that gives the count of the different message types for the last 7 days. Another panel provides the unique count of one type of message over 7 days. The third type is supposed to show the number of messages that have duplicates and this should be as simple as the difference between the two panels for one type of message. i.e

Total Message A - Unique Count Message A = Duplicate Count Message A

However no matter how I have reconstructed the searches and panel, I cannot get the numbers to coincide. I have got fantastic help from people on this forum with the searches but just want to perhaps understand why there is a difference and if there is a fix.

eg.

Panel 1 (different types counts)

sourcetype="logs.stats" | timechart count by message_type | fields _time Log Report Thread

for example yesterdays count for Log = 1947075

Panel 2 (unique count for type message Log)

source="/logs.stats/tcp/10057" message_type="Log"|  timechart dc(log_id)

for example yesterdays unique count = 856790

Panel 3 (duplicate count for type message Log)

source="/logs.stats/tcp/10057" message_type="Log" | bucket _time span=day 
 | stats count(log_id) as totalCount by _time
 | appendcols [ search 
    source="/logs.stats/tcp/10057" message_type="Log" 
    | bucket _time span=day 
    | eventstats dc(Log_id) as uniquetotal | eventstats count as duplicates by log_id| stats count(eval(duplicates=1)) as duplicates values(uniquetotal) as uniquetotal
    ]                          
 | eval dupCount = totalCount-uniquetotal
 | table totalCount dupCount uniquetotal

These totals = totalCount =3894252 ; dupCount =3565952 ; uniquetotal= 328300 ;

As you can see the numbers are complete off. Any ideas appreciated

0 Karma

gokadroid
Motivator

Is capitalization messing it up, if this is your exact query.. stats count( log_id ) as totalCount vs. eventstats dc( Log_id ) as uniquetotal??

0 Karma

jdepp
Path Finder

sorry that was just a type-o copy and paste

0 Karma

somesoni2
Revered Legend

In the third search, the uniquetotal field is calculated for whole period, not per day, how would it be comparable with total count per day query? Should you be comparing both counts on day-by-day basis like this?

source="/logs.stats/tcp/10057" message_type="Log"  | timechart span=1d count(log_id) as totalCount dc(log_id) as uniquetotal  | eval dupCount = totalCount-uniquetotal
  | table _time totalCount dupCount uniquetotal
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...