Splunk Search

tstats count on accelerated data models giving different results after a few days

arjit
Path Finder

Hi All,

We have schedule the job which would run a tstats command on an accelerated data model for yesterday’s data & this populates the count value to an index called “xyz” via collect command.

tstats count as "COUNT VALUE"  from datamodel="abc" 

where ..... 

|collect index=xyz addTime=T

When I am running tstats query and index=xyz count query for couple of days, the results are matching (which they should) but when I am running this tstats query on the same dataset for the same time period, after say a few days & comparing with the index=xyz for that date, the tstats query gives me a different result (though index=xyz result is same as what I got that day). The tstats count value seems to be increasing with time... May I know why the tstats count values are changing over the period & how to fix this issue?

Thanks

AG

Labels (2)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...