Splunk Search

tstats results different from eventcount

marian_coman
Explorer

Can anyone provide an explanation on why these two searches produce different results? I am trying to set up an alert for the case when an index does not have logs in the last couple of hours (time condition on tstats removed for the example below):

| tstats latest(_time) as latest where index=* by index

returns 51 of my indexes, while:

| eventcount summarize=false index=* | dedup index | fields index

would return all of my 87 indexes.

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The tstats command runs statistics on the specified parameter based on the time range. Hence you get the actual count. The eventcount command doen't need time range. Specifying a time range has no effect on the results returned by the eventcount command. All of the events on the indexes you specify are counted.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The tstats command runs statistics on the specified parameter based on the time range. Hence you get the actual count. The eventcount command doen't need time range. Specifying a time range has no effect on the results returned by the eventcount command. All of the events on the indexes you specify are counted.

marian_coman
Explorer

Thanks. Indeed the tstats returns time range results. However your answer help me realize the difference, that being that the result are different as some indexes have never received logs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...