Splunk Search

stats count(*) as * by host VERSUS stats count(kpi1) as kpi1 ... by host.

Motivator

I ultimately want to understand the difference between these 2 searches and why I get different results?

stats count(*) as * by host VERSUS stats count(kpi1) as kpi1 ... by host.

Implicit VERSUS Explicit listing of all the KPIs available.

I want to display all the KPIs available.

So i do this:
1/

... | stats count(*) as * by host | transpose

which will give me the list of all KPIs

column  row 1
1   aDevice DeviceName
2   Time    1
3   Kpi1    1
4   Kpi2    1
5   Kpi3    1
...

Alternatively, I can do this, explicitly naming all the KPIs I want to appear.

2/

| stats 
count(Time) as Time
count(Kpi1) as Kpi1
....
by host

which will give me (in theory) the same result

column  row 1
1   aDevice DeviceName
2   Time    1
3   Kpi1    1
4   Kpi2    1
5   Kpi3    1
...

In theory, they should give the same result, that is X number of rows with each row representing a KPI.

But what I have noticed is that 2/ gives the correct results, that is the correct number of rows for each kpi.

1/ on the other hand only gives a subset of them (e.g. 2/ would give 172 rows and 1/ would give <100 rows and this number would vary). And I am not sure why. I would have thought they would be the same.

This is an example of the event that comes up for the chosen time frame that the 2 searches are applied across:
So basically everything appears the same with the difference bein the search 1/ stats count(*) as * by host v 2/ stats count(kpi1) as kpi1 ... by host

Time    Event
11/19/18
12:00:00.000 AM 
2018-11-19T00:00:00+1300,2416,2520,4,8,2,6,2,1,373,373,327,225,61044,0,7,477,0,515,0,0,0,515,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,10,10,794,795,0,0,426,230,146,0,0,0,157,0,0,2,0,103154497,,,,,,,,,,,,,,,,,8805,587,8745,583,,,60,4,9328,621,8745,583,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,,,,,0,0,50.0000,0.0000,0.0000,0.0000,50.0000,37,3,3,4,0,0,0,0.0000,0,37,0,26724,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0.0000,0.0000,0.0000,0.0000,0,0,0,0,0,0,0,0,0,0,0.0000,0.0000,0,18,0,0,0,0,0,0,0,4.7438,4.7438,3.2490,11027,0,1716,,,,,,,0,0,0,0,0,0
Tags (3)
0 Karma

SplunkTrust
SplunkTrust

Is the wildcarded version creating too many fields to unpack hitting a limit, etc? If so you should see something about that in the search.log within the job inspector.

You might also see it in the counts section of the job inspector... where 1.2 million events go in and only 10k come out, etc.