Splunk Search

Why is stats count by sourcetype missing some sourcetypes?

index=app_xxxxxxxxx_products cluster_name=dxx-exx-awslab sourcetype=xxxxxxx:deployment-info | stats count by sourcetype

Returns count for the sourcetype but when ran as :

index=app_xxxxxxxxx_products cluster_name=dxx-exx-awslab  | stats count by sourcetype

The results don't include the sourcetype mentioned in firsts search.

0 Karma


Hi dilpreetsingh,
do events with sourcetype=xxxxxxx:deployment-info continously arrive or not?
did you used the same time period (e.g. earliest=-2h@h latest=-h@h)? don't use latest=now.


0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!