Splunk Search

tstats results different from eventcount

marian_coman
Explorer

Can anyone provide an explanation on why these two searches produce different results? I am trying to set up an alert for the case when an index does not have logs in the last couple of hours (time condition on tstats removed for the example below):

| tstats latest(_time) as latest where index=* by index

returns 51 of my indexes, while:

| eventcount summarize=false index=* | dedup index | fields index

would return all of my 87 indexes.

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The tstats command runs statistics on the specified parameter based on the time range. Hence you get the actual count. The eventcount command doen't need time range. Specifying a time range has no effect on the results returned by the eventcount command. All of the events on the indexes you specify are counted.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The tstats command runs statistics on the specified parameter based on the time range. Hence you get the actual count. The eventcount command doen't need time range. Specifying a time range has no effect on the results returned by the eventcount command. All of the events on the indexes you specify are counted.

marian_coman
Explorer

Thanks. Indeed the tstats returns time range results. However your answer help me realize the difference, that being that the result are different as some indexes have never received logs.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...