Hello all, Running the following search (direct count) at different times of the day for the same time period I receive different results; sourcetype=x index=y access_method="Explicit Proxy" | table app,category,activity,user | dedup user | stats dc(user) by app I can use this search but also get different results for the same time period, last 90 days; sourcetype=x index=y access_method="Explicit Proxy" | table app,category,activity,user | dedup user | stats count by app Results look like this; App dc(user) app 1 499 app2 36 app3 19 Any suggestions on what maybe my issue? Thanks
... View more