Hi, I'm running the following searches and getting different results for the same time range (All time) when comparing projects.
For example:
For this search, I'm getting many projects and their total unique "Defect ID"s. For the ACTIVATION project, I'm getting 23 results:
index="my_index" source="my_csv.csv"
| dedup "Defect ID"
| stats count by "Project Name"
For this search, I'm getting 36 results.:
index="my_index" source="my_csv.csv" "Project Name"=ACTIVATION
| dedup "Defect ID"
| stats count by "Project Name"
Why when I'm adding the "Project Name"=ACTIVATION to the search I'm getting MORE results?
When adding the | search "Project Name"=ACTIVATION somewhere after the dedup command I'm still getting 23
index="my_index" source="my_csv.csv" "Project Name"=ACTIVATION
| dedup "Defect ID"
| search "Project Name"=ACTIVATION
| stats count by "Project Name"
... View more