Splunk Search

tstats results different from eventcount

marian_coman
Explorer

Can anyone provide an explanation on why these two searches produce different results? I am trying to set up an alert for the case when an index does not have logs in the last couple of hours (time condition on tstats removed for the example below):

| tstats latest(_time) as latest where index=* by index

returns 51 of my indexes, while:

| eventcount summarize=false index=* | dedup index | fields index

would return all of my 87 indexes.

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The tstats command runs statistics on the specified parameter based on the time range. Hence you get the actual count. The eventcount command doen't need time range. Specifying a time range has no effect on the results returned by the eventcount command. All of the events on the indexes you specify are counted.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The tstats command runs statistics on the specified parameter based on the time range. Hence you get the actual count. The eventcount command doen't need time range. Specifying a time range has no effect on the results returned by the eventcount command. All of the events on the indexes you specify are counted.

marian_coman
Explorer

Thanks. Indeed the tstats returns time range results. However your answer help me realize the difference, that being that the result are different as some indexes have never received logs.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...