Splunk Search

Why do these 2 searches return different results based on the dedup?

tkwaller_2
Communicator

Simple searches that return different restults based on where the dedup is. Seems like ti functuioning 2 different ways:

index=dev_tsv md_type="assets" info_owner_orgID="Test" related_vendors="*gibberish*" info_tags="<tagname>"
| dedup id
| stats count by id

But this one returns a different result set than the one above

index=dev_tsv md_type="assets" info_owner_orgID="Test" related_vendors="*gibberish*"
|dedup id
| search info_tags="<tagname>"
| stats count by id

Any thoughts would be helpful.
Thanks as always!

0 Karma
1 Solution

HiroshiSatoh
Champion

First search:
(Info_tags = "<tagname>") only logs are extracted.

Next search:
Logs that are not (info_tags = "<tagname>") are also extracted.
The next dedup may delete the log with (info_tags = "<tagname>") and leave a log without (info_tags = "<tagname>").

I think that there is a difference in the number of cases due to the above difference.

View solution in original post

HiroshiSatoh
Champion

First search:
(Info_tags = "<tagname>") only logs are extracted.

Next search:
Logs that are not (info_tags = "<tagname>") are also extracted.
The next dedup may delete the log with (info_tags = "<tagname>") and leave a log without (info_tags = "<tagname>").

I think that there is a difference in the number of cases due to the above difference.

tkwaller_2
Communicator

This I understand BUT I would think the first search would be a smaller result but its not, it returns 146 results the second search only returns 94.

The first search returns results from 2 times on the same day 52 at 12AM and 94 at 3PM BUT the second only returns one set, 94 at 3PM

It appears the first search is just ensuring there are no duplicate ids for the ones with info_tags, in the second its its ensuring we only get the most recent ids with info_tags.

Why would it function 2 different ways?

0 Karma

HiroshiSatoh
Champion

The number of second searches to be deleted by dedup decreases.

0 Karma

HiroshiSatoh
Champion

search1
ID=1,info_tags=B
ID=2,info_tags=B
ID=3,info_tags=B

search2
ID=1,info_tags=A
ID=1,info_tags=B
ID=2,info_tags=B
ID=2,info_tags=C
ID=3,info_tags=B
ID=3,info_tags=D
↓ dedup
ID=1,info_tags=A
ID=2,info_tags=B
ID=3,info_tags=B
↓ search info_tags=B
ID=2,info_tags=B
ID=3,info_tags=B

0 Karma

tkwaller_2
Communicator

OK I can see now what you mean, since its taking the most recent record and deduping BEFORE getting the info_tag its reduces the overall count. That makes sense.

Thanks for that

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...