Splunk Search

Why does count and dc behave differently?

palisetty
Communicator

I have written the query

index="main" host="web_application" 
| stats count by status

The result is:

status count
200 233056
400 4156
403 1658
404 3652
406 4184
408 4142
500 4088

I am happy with this. But when I use dc for the same,

index="main" host="web_application" 
| stats dc by status

I get:

status dc(JSESSIONID) dc(action) dc(bytes) dc(categoryId) dc(clientip) dc(date_hour) dc(date_mday) dc(date_minute) dc(date_month) dc(date_second) dc(date_wday) dc(date_year) dc(date_zone) dc(detail) dc(file) dc(host) dc(ident) dc(index) dc(items) dc(linecount) dc(method) dc(msg) dc(other) dc(password) dc(pg) dc(productId) dc(punct) dc(q) dc(referer) dc(referer_domain) dc(req_time) dc(root) dc(source) dc(sourcetype) dc(splunk_server) dc(start) dc(t) dc(timeendpos) dc(timestartpos) dc(uri) dc(uri_path) dc(uri_query) dc(user) dc(useragent) dc(version)
200 11192 5 3802 7 183 24 30 60 2 60 7 1 1 1 10 1 1 1 0 1 2 5 902 1 9 16 105 1 110 5 106359 2 1 1 1 1 0 7 7 95883 12 95879 1 26 1
400 1837 5 1595 1 182 24 30 60 2 60 7 1 1 0 5 1 1 1 0 1 2 0 794 0 0 2 80 0 13 4 2078 0 1 1 1 0 0 7 7 2021 5 2021 1 26 1
403 670 5 657 1 178 24 30 60 2 60 7 1 1 2 6 1 1 1 0 1 2 0 536 0 0 1 70 0 15 4 826 1 1 1 1 0 0 7 7 713 6 712 1 26 1
404 1624 5 1471 1 183 24 30 60 2 60 7 1 1 0 21 1 1 1 1 1 2 0 793 0 0 2 87 0 16 4 1826 7 1 1 1 0 1 7 7 1803 26 1743 1 26 1
406 1850 5 1635 1 182 24 30 60 2 60 7 1 1 0 5 1

Why is this? What is that I am missing?
It may be a dumb question but.

Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

dc is Distinct Count. It says how many unique values of the given field(s) exist. Since you did not supply a field name, it counted all fields and grouped them by the status field values.

Had you used dc(status) the result should have been 7.

count and dc generally are not interchangeable.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

dc is Distinct Count. It says how many unique values of the given field(s) exist. Since you did not supply a field name, it counted all fields and grouped them by the status field values.

Had you used dc(status) the result should have been 7.

count and dc generally are not interchangeable.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...