Splunk Search

Why is the calculated count for a field showing way more than the actual events?

jordanking1992
Path Finder

Hello,

I am having trouble understanding why the counts for a particular field are off. The time frames for both the screenshots below are the same. The only difference is the view for the results.

The first screenshot says the count for namespace field "example" is 261,158 and the search used was:

index=network

The second screenshot says the count for namespace field "example" is 435 and the search used was:

index=network namespace=example

You can see that there is a drastic difference in "count" for the namespace field "example".

Thoughts?

0 Karma
1 Solution

afurrowgtri
Explorer

What happens if you add this before your stats? I suspect it may be making some assumptions when the namespace field is null.

| eval namespace=case(isnotnull(namespace),namespace)

Does | stats dc(namespace) also produce erroneous results?

View solution in original post

0 Karma

afurrowgtri
Explorer

What happens if you add this before your stats? I suspect it may be making some assumptions when the namespace field is null.

| eval namespace=case(isnotnull(namespace),namespace)

Does | stats dc(namespace) also produce erroneous results?

0 Karma

jordanking1992
Path Finder

Apologies, the eval command worked and showed me the where the rest of the count was coming from.

Thank you for your help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...