I ultimately want to understand the difference between these 2 searches and why I get different results?
stats count(*) as * by host VERSUS stats count(kpi1) as kpi1 ... by host.
Implicit VERSUS Explicit listing of all the KPIs available.
I want to display all the KPIs available.
So i do this:
1/
... | stats count(*) as * by host | transpose
which will give me the list of all KPIs
column row 1
1 aDevice DeviceName
2 Time 1
3 Kpi1 1
4 Kpi2 1
5 Kpi3 1
...
Alternatively, I can do this, explicitly naming all the KPIs I want to appear.
2/
| stats
count(Time) as Time
count(Kpi1) as Kpi1
....
by host
which will give me (in theory) the same result
column row 1
1 aDevice DeviceName
2 Time 1
3 Kpi1 1
4 Kpi2 1
5 Kpi3 1
...
In theory, they should give the same result, that is X number of rows with each row representing a KPI.
But what I have noticed is that 2/ gives the correct results, that is the correct number of rows for each kpi.
1/ on the other hand only gives a subset of them (e.g. 2/ would give 172 rows and 1/ would give <100 rows and this number would vary). And I am not sure why. I would have thought they would be the same.
This is an example of the event that comes up for the chosen time frame that the 2 searches are applied across:
So basically everything appears the same with the difference bein the search 1/ stats count(*) as * by host v 2/ stats count(kpi1) as kpi1 ... by host
Time Event
11/19/18
12:00:00.000 AM
2018-11-19T00:00:00+1300,2416,2520,4,8,2,6,2,1,373,373,327,225,61044,0,7,477,0,515,0,0,0,515,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,10,10,794,795,0,0,426,230,146,0,0,0,157,0,0,2,0,103154497,,,,,,,,,,,,,,,,,8805,587,8745,583,,,60,4,9328,621,8745,583,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,0,0,50.0000,0.0000,0.0000,0.0000,50.0000,37,3,3,4,0,0,0,0.0000,0,37,0,26724,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0.0000,0.0000,0.0000,0.0000,0,0,0,0,0,0,0,0,0,0,0.0000,0.0000,0,18,0,0,0,0,0,0,0,4.7438,4.7438,3.2490,11027,0,1716,,,,,,,0,0,0,0,0,0
