I have a timeline panel that gives the count of the different message types for the last 7 days. Another panel provides the unique count of one type of message over 7 days. The third type is supposed to show the number of messages that have duplicates and this should be as simple as the difference between the two panels for one type of message. i.e Total Message A - Unique Count Message A = Duplicate Count Message A However no matter how I have reconstructed the searches and panel, I cannot get the numbers to coincide. I have got fantastic help from people on this forum with the searches but just want to perhaps understand why there is a difference and if there is a fix. eg. Panel 1 (different types counts) sourcetype="logs.stats" | timechart count by message_type | fields _time Log Report Thread for example yesterdays count for Log = 1947075 Panel 2 (unique count for type message Log) source="/logs.stats/tcp/10057" message_type="Log"| timechart dc(log_id) for example yesterdays unique count = 856790 Panel 3 (duplicate count for type message Log) source="/logs.stats/tcp/10057" message_type="Log" | bucket _time span=day | stats count(log_id) as totalCount by _time | appendcols [ search source="/logs.stats/tcp/10057" message_type="Log" | bucket _time span=day | eventstats dc(Log_id) as uniquetotal | eventstats count as duplicates by log_id| stats count(eval(duplicates=1)) as duplicates values(uniquetotal) as uniquetotal ] | eval dupCount = totalCount-uniquetotal | table totalCount dupCount uniquetotal These totals = totalCount =3894252 ; dupCount =3565952 ; uniquetotal= 328300 ; As you can see the numbers are complete off. Any ideas appreciated ... View more

I have tried multiple ways to do this including join, append but in each case all I get is one column result being displayed. I asked a similar but more difficult question related to dupes but the counts are still off so I went with the simpler query option. source="/logs.stats/tcp/1000" message_type="Log" | bucket _time span=day | stats count(log_id) as totalCount by _time | stats dc(log_id) as nonduplicates by _time | eval dupCount = totalCount - nonduplicates | table nonduplicates uniqueCount Please assist with this as I did not realize how difficult some of these panel creations and queries can be. ... View more

I am trying to display the single total count of all messages for the current day that have the same values for a single field. I had a previous search that did just that and displayed it against the total messages but there is a question on the counts, so I need to display the single duplicate count to overcome any uncertainty. source="/msg.stats/tcp/999" | where message_type="Log" | eventstats count as total | eventstats count as duplicates by log_id| stats count(eval(duplicates>1)) as no_duplicates values(total) as total | eval dupPercentage=no_duplicates/total*100 I thought this was working but a team member disputes the dupe stats as being too high. I assumed a simple search to display dupes would clear this up. source="/msg.stats/tcp/999" | where message_type="Log" | stats count(eval(log_id>1)) as no_duplicates I want to make sure that I have the searches correct so I can confidently accept the counts. ... View more

I would like to create a timeline chart panel that displays the distinct count of events based on some field and then groups the timeline based on a string datetime field. I think I have it but need to confirm this is the right and best way. sourcetype="data.stats" | where message_type="Check" | convert timeformat="%Y-%m-%d" ctime(pdate) AS date | timechart dc(check_id) by date I think it's right but not sure as it does resemble this panel which would be correct if the date field corresponded to the current datetime. sourcetype="data.stats" | where message_type="Check" | timechart dc(check_id) Appreciate help on this. ... View more

I am able to set up alerts for an index when the count = 0 for a specific parameter value. Since I have over 50 over these values, it is cumbersome to create so many alerts and wondered if I can create one alert that is able to monitor across these values. Let me explain with example: source="/statsData.newIndex/tcp/10014" This is the general search for the main index but for the specific parameter value: source="/statsData.newIndex/tcp/10014" PStream=864 So I set up alerts for multiple values of this PStream field that monitors the count, and alerts when count =0 for the last hour. Is there a way to construct the search so that it monitors all values of this field PStream and for each one if the count =0, I will get the appropriate alert? ... View more