Splunk Search

Why are different search panels returning inconsistent results?

jdepp
Path Finder

I have a timeline panel that gives the count of the different message types for the last 7 days. Another panel provides the unique count of one type of message over 7 days. The third type is supposed to show the number of messages that have duplicates and this should be as simple as the difference between the two panels for one type of message. i.e

Total Message A - Unique Count Message A = Duplicate Count Message A

However no matter how I have reconstructed the searches and panel, I cannot get the numbers to coincide. I have got fantastic help from people on this forum with the searches but just want to perhaps understand why there is a difference and if there is a fix.

eg.

Panel 1 (different types counts)

sourcetype="logs.stats" | timechart count by message_type | fields _time Log Report Thread

for example yesterdays count for Log = 1947075

Panel 2 (unique count for type message Log)

source="/logs.stats/tcp/10057" message_type="Log"|  timechart dc(log_id)

for example yesterdays unique count = 856790

Panel 3 (duplicate count for type message Log)

source="/logs.stats/tcp/10057" message_type="Log" | bucket _time span=day 
 | stats count(log_id) as totalCount by _time
 | appendcols [ search 
    source="/logs.stats/tcp/10057" message_type="Log" 
    | bucket _time span=day 
    | eventstats dc(Log_id) as uniquetotal | eventstats count as duplicates by log_id| stats count(eval(duplicates=1)) as duplicates values(uniquetotal) as uniquetotal
    ]                          
 | eval dupCount = totalCount-uniquetotal
 | table totalCount dupCount uniquetotal

These totals = totalCount =3894252 ; dupCount =3565952 ; uniquetotal= 328300 ;

As you can see the numbers are complete off. Any ideas appreciated

0 Karma

gokadroid
Motivator

Is capitalization messing it up, if this is your exact query.. stats count( log_id ) as totalCount vs. eventstats dc( Log_id ) as uniquetotal??

0 Karma

jdepp
Path Finder

sorry that was just a type-o copy and paste

0 Karma

somesoni2
SplunkTrust
SplunkTrust

In the third search, the uniquetotal field is calculated for whole period, not per day, how would it be comparable with total count per day query? Should you be comparing both counts on day-by-day basis like this?

source="/logs.stats/tcp/10057" message_type="Log"  | timechart span=1d count(log_id) as totalCount dc(log_id) as uniquetotal  | eval dupCount = totalCount-uniquetotal
  | table _time totalCount dupCount uniquetotal
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...