Splunk Search

Why does count and dc behave differently?

palisetty
Communicator

I have written the query

index="main" host="web_application" 
| stats count by status

The result is:

status count
200 233056
400 4156
403 1658
404 3652
406 4184
408 4142
500 4088

I am happy with this. But when I use dc for the same,

index="main" host="web_application" 
| stats dc by status

I get:

status dc(JSESSIONID) dc(action) dc(bytes) dc(categoryId) dc(clientip) dc(date_hour) dc(date_mday) dc(date_minute) dc(date_month) dc(date_second) dc(date_wday) dc(date_year) dc(date_zone) dc(detail) dc(file) dc(host) dc(ident) dc(index) dc(items) dc(linecount) dc(method) dc(msg) dc(other) dc(password) dc(pg) dc(productId) dc(punct) dc(q) dc(referer) dc(referer_domain) dc(req_time) dc(root) dc(source) dc(sourcetype) dc(splunk_server) dc(start) dc(t) dc(timeendpos) dc(timestartpos) dc(uri) dc(uri_path) dc(uri_query) dc(user) dc(useragent) dc(version)
200 11192 5 3802 7 183 24 30 60 2 60 7 1 1 1 10 1 1 1 0 1 2 5 902 1 9 16 105 1 110 5 106359 2 1 1 1 1 0 7 7 95883 12 95879 1 26 1
400 1837 5 1595 1 182 24 30 60 2 60 7 1 1 0 5 1 1 1 0 1 2 0 794 0 0 2 80 0 13 4 2078 0 1 1 1 0 0 7 7 2021 5 2021 1 26 1
403 670 5 657 1 178 24 30 60 2 60 7 1 1 2 6 1 1 1 0 1 2 0 536 0 0 1 70 0 15 4 826 1 1 1 1 0 0 7 7 713 6 712 1 26 1
404 1624 5 1471 1 183 24 30 60 2 60 7 1 1 0 21 1 1 1 1 1 2 0 793 0 0 2 87 0 16 4 1826 7 1 1 1 0 1 7 7 1803 26 1743 1 26 1
406 1850 5 1635 1 182 24 30 60 2 60 7 1 1 0 5 1

Why is this? What is that I am missing?
It may be a dumb question but.

Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

dc is Distinct Count. It says how many unique values of the given field(s) exist. Since you did not supply a field name, it counted all fields and grouped them by the status field values.

Had you used dc(status) the result should have been 7.

count and dc generally are not interchangeable.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

dc is Distinct Count. It says how many unique values of the given field(s) exist. Since you did not supply a field name, it counted all fields and grouped them by the status field values.

Had you used dc(status) the result should have been 7.

count and dc generally are not interchangeable.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...