Splunk Search

tstats count on accelerated data models giving different results after a few days

arjit
Path Finder

Hi All,

We have schedule the job which would run a tstats command on an accelerated data model for yesterday’s data & this populates the count value to an index called “xyz” via collect command.

tstats count as "COUNT VALUE"  from datamodel="abc" 

where ..... 

|collect index=xyz addTime=T

When I am running tstats query and index=xyz count query for couple of days, the results are matching (which they should) but when I am running this tstats query on the same dataset for the same time period, after say a few days & comparing with the index=xyz for that date, the tstats query gives me a different result (though index=xyz result is same as what I got that day). The tstats count value seems to be increasing with time... May I know why the tstats count values are changing over the period & how to fix this issue?

Thanks

AG

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...