Splunk Search

Why does statistics from a tstats change while the search executes and at the end result is not complete?


If I run the below search the statistics output changes while the search is progressing and when the search is completed not all results that was seen during the search is visible. 

| tstats summariesonly=f count from datamodel=Network_Traffic by All_Traffic.app,All_Traffic.src,All_Traffic.dest,All_Traffic.dest_port,All_Traffic.action
| lookup xxxx CIDR AS All_Traffic.src OUTPUT CIDR as cidr_ip2 fullzonename as sourcenetwork ZoneType as sourcezonetype
| lookup xxxx CIDR AS All_Traffic.dest OUTPUT fullzonename as destinationnetwork ZoneType as destinationzonetype
| where (cidrmatch(cidr_ip2,'All_Traffic.src'))
| search sourcezonetype="yyyy" AND destinationzonetype!="*zzzz"
| stats count by sourcenetwork sourcezonetype destinationnetwork destinationzonetype All_Traffic.action

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...