Splunk Search

## stats count(*) as * by host VERSUS stats count(kpi1) as kpi1 ... by host.

Motivator

I ultimately want to understand the difference between these 2 searches and why I get different results?

stats count(*) as * by host VERSUS stats count(kpi1) as kpi1 ... by host.

Implicit VERSUS Explicit listing of all the KPIs available.

I want to display all the KPIs available.

So i do this:
1/

``````... | stats count(*) as * by host | transpose
``````

which will give me the list of all KPIs

``````column  row 1
2   Time    1
3   Kpi1    1
4   Kpi2    1
5   Kpi3    1
...
``````

Alternatively, I can do this, explicitly naming all the KPIs I want to appear.

2/

``````| stats
count(Time) as Time
count(Kpi1) as Kpi1
....
by host
``````

which will give me (in theory) the same result

``````column  row 1
2   Time    1
3   Kpi1    1
4   Kpi2    1
5   Kpi3    1
...
``````

In theory, they should give the same result, that is X number of rows with each row representing a KPI.

But what I have noticed is that 2/ gives the correct results, that is the correct number of rows for each kpi.

1/ on the other hand only gives a subset of them (e.g. 2/ would give 172 rows and 1/ would give <100 rows and this number would vary). And I am not sure why. I would have thought they would be the same.

This is an example of the event that comes up for the chosen time frame that the 2 searches are applied across:
So basically everything appears the same with the difference bein the search 1/ `stats count(*) as * by host` v 2/ `stats count(kpi1) as kpi1 ... by host`

``````Time    Event
11/19/18
12:00:00.000 AM
2018-11-19T00:00:00+1300,2416,2520,4,8,2,6,2,1,373,373,327,225,61044,0,7,477,0,515,0,0,0,515,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,10,10,794,795,0,0,426,230,146,0,0,0,157,0,0,2,0,103154497,,,,,,,,,,,,,,,,,8805,587,8745,583,,,60,4,9328,621,8745,583,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,0,0,50.0000,0.0000,0.0000,0.0000,50.0000,37,3,3,4,0,0,0,0.0000,0,37,0,26724,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0.0000,0.0000,0.0000,0.0000,0,0,0,0,0,0,0,0,0,0,0.0000,0.0000,0,18,0,0,0,0,0,0,0,4.7438,4.7438,3.2490,11027,0,1716,,,,,,,0,0,0,0,0,0
``````
Tags (3)
SplunkTrust

Is the wildcarded version creating too many fields to unpack hitting a limit, etc? If so you should see something about that in the search.log within the job inspector.

You might also see it in the counts section of the job inspector... where 1.2 million events go in and only 10k come out, etc.