tstats results different from eventcount

[marian_coman]

Can anyone provide an explanation on why these two searches produce different results? I am trying to set up an alert for the case when an index does not have logs in the last couple of hours (time condition on tstats removed for the example below):

| tstats latest(_time) as latest where index=* by index

returns 51 of my indexes, while:

| eventcount summarize=false index=* | dedup index | fields index

would return all of my 87 indexes.

Thanks!

[somesoni2 · Accepted solution]

The tstats command runs statistics on the specified parameter based on the time range. Hence you get the actual count. The eventcount command doen't need time range. Specifying a time range has no effect on the results returned by the eventcount command. All of the events on the indexes you specify are counted.

[marian_coman]

Thanks. Indeed the tstats returns time range results. However your answer help me realize the difference, that being that the result are different as some indexes have never received logs.