Why is my search returning a different set of results after I replaced the 'dedup' command with 'stats dc()' to improve performance?

[IRHM73]

Hi,

I wonder whether someone may be able to help me please.

I'm using the search below to successfully produce a given group of stats:

auditSource=ts auditType=RenewalStarted NOT [search auditSource=ts auditType=RenewalCompleted | table detail.nino] |
iplocation tags.clientIP |dedup detail.nino | fillnull value="Country Not Found" Country | stats count by Country

Because I know that the dedup command can be resource intensive, I've tried changing this by using the stats dc command as below:

auditSource=ts auditType=RenewalStarted NOT [search auditSource=ts auditType=RenewalCompleted | table detail.nino] |
iplocation tags.clientIP | fillnull value="Country Not Found" Country | stats dc(detail.nino) By Country

The problem I have is that although I'm using the same date period, the search is not returning the same set of results.

I just wondered whether someone may be able to look at this please and offer some guidance on where I may have gone wrong.

Many thanks and kind regards

Chris

[IRHM73 · Accepted solution]

Hi thank you for coming back to me. When I omit the fillnull from the second query the number of events are still greater than the initial query and the count significantly reduced.

However If I changed the latter query to auditSource=tc auditType=TCStarted NOT [search auditSource=tc auditType=TCCompleted | table detail.nino] | iplocation tags.clientIP | fillnull value="Country Not Found" | stats dc(detail.nino) By Country which is now working perfectly.

Kind regards

Chris

[woodcock]

Is it the same without the fillnull command?