Splunk Search

Why are different search panels returning inconsistent results?

jdepp
Path Finder

I have a timeline panel that gives the count of the different message types for the last 7 days. Another panel provides the unique count of one type of message over 7 days. The third type is supposed to show the number of messages that have duplicates and this should be as simple as the difference between the two panels for one type of message. i.e

Total Message A - Unique Count Message A = Duplicate Count Message A

However no matter how I have reconstructed the searches and panel, I cannot get the numbers to coincide. I have got fantastic help from people on this forum with the searches but just want to perhaps understand why there is a difference and if there is a fix.

eg.

Panel 1 (different types counts)

sourcetype="logs.stats" | timechart count by message_type | fields _time Log Report Thread

for example yesterdays count for Log = 1947075

Panel 2 (unique count for type message Log)

source="/logs.stats/tcp/10057" message_type="Log"|  timechart dc(log_id)

for example yesterdays unique count = 856790

Panel 3 (duplicate count for type message Log)

source="/logs.stats/tcp/10057" message_type="Log" | bucket _time span=day 
 | stats count(log_id) as totalCount by _time
 | appendcols [ search 
    source="/logs.stats/tcp/10057" message_type="Log" 
    | bucket _time span=day 
    | eventstats dc(Log_id) as uniquetotal | eventstats count as duplicates by log_id| stats count(eval(duplicates=1)) as duplicates values(uniquetotal) as uniquetotal
    ]                          
 | eval dupCount = totalCount-uniquetotal
 | table totalCount dupCount uniquetotal

These totals = totalCount =3894252 ; dupCount =3565952 ; uniquetotal= 328300 ;

As you can see the numbers are complete off. Any ideas appreciated

0 Karma

gokadroid
Motivator

Is capitalization messing it up, if this is your exact query.. stats count( log_id ) as totalCount vs. eventstats dc( Log_id ) as uniquetotal??

0 Karma

jdepp
Path Finder

sorry that was just a type-o copy and paste

0 Karma

somesoni2
SplunkTrust
SplunkTrust

In the third search, the uniquetotal field is calculated for whole period, not per day, how would it be comparable with total count per day query? Should you be comparing both counts on day-by-day basis like this?

source="/logs.stats/tcp/10057" message_type="Log"  | timechart span=1d count(log_id) as totalCount dc(log_id) as uniquetotal  | eval dupCount = totalCount-uniquetotal
  | table _time totalCount dupCount uniquetotal
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...