Splunk Search

Why does count and dc behave differently?

palisetty
Communicator

I have written the query

index="main" host="web_application" 
| stats count by status

The result is:

status count
200 233056
400 4156
403 1658
404 3652
406 4184
408 4142
500 4088

I am happy with this. But when I use dc for the same,

index="main" host="web_application" 
| stats dc by status

I get:

status dc(JSESSIONID) dc(action) dc(bytes) dc(categoryId) dc(clientip) dc(date_hour) dc(date_mday) dc(date_minute) dc(date_month) dc(date_second) dc(date_wday) dc(date_year) dc(date_zone) dc(detail) dc(file) dc(host) dc(ident) dc(index) dc(items) dc(linecount) dc(method) dc(msg) dc(other) dc(password) dc(pg) dc(productId) dc(punct) dc(q) dc(referer) dc(referer_domain) dc(req_time) dc(root) dc(source) dc(sourcetype) dc(splunk_server) dc(start) dc(t) dc(timeendpos) dc(timestartpos) dc(uri) dc(uri_path) dc(uri_query) dc(user) dc(useragent) dc(version)
200 11192 5 3802 7 183 24 30 60 2 60 7 1 1 1 10 1 1 1 0 1 2 5 902 1 9 16 105 1 110 5 106359 2 1 1 1 1 0 7 7 95883 12 95879 1 26 1
400 1837 5 1595 1 182 24 30 60 2 60 7 1 1 0 5 1 1 1 0 1 2 0 794 0 0 2 80 0 13 4 2078 0 1 1 1 0 0 7 7 2021 5 2021 1 26 1
403 670 5 657 1 178 24 30 60 2 60 7 1 1 2 6 1 1 1 0 1 2 0 536 0 0 1 70 0 15 4 826 1 1 1 1 0 0 7 7 713 6 712 1 26 1
404 1624 5 1471 1 183 24 30 60 2 60 7 1 1 0 21 1 1 1 1 1 2 0 793 0 0 2 87 0 16 4 1826 7 1 1 1 0 1 7 7 1803 26 1743 1 26 1
406 1850 5 1635 1 182 24 30 60 2 60 7 1 1 0 5 1

Why is this? What is that I am missing?
It may be a dumb question but.

Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

dc is Distinct Count. It says how many unique values of the given field(s) exist. Since you did not supply a field name, it counted all fields and grouped them by the status field values.

Had you used dc(status) the result should have been 7.

count and dc generally are not interchangeable.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

dc is Distinct Count. It says how many unique values of the given field(s) exist. Since you did not supply a field name, it counted all fields and grouped them by the status field values.

Had you used dc(status) the result should have been 7.

count and dc generally are not interchangeable.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...