Splunk Search

Why is the number of host values for the same time period different in tstats vs search on wineventlogs?

landen99
Motivator

I search the same time period in wineventlogs for host values with tstats (37,558) and with regular search (42,008):

| tstats count where index=wineventlog sourcetype=wineventlog
(TERM(LogName=Microsoft-Windows-PowerShell/Operational) OR TERM(SourceName=Microsoft-Windows-PowerShell))
(TERM(EventCode=4103) OR TERM(EventCode=4104) OR TERM(EventCode=4105) OR TERM(EventCode=4106)) by host

versus:

index=wineventlog sourcetype=wineventlog
(TERM(LogName=Microsoft-Windows-PowerShell/Operational) OR TERM(SourceName=Microsoft-Windows-PowerShell))
(TERM(EventCode=4103) OR TERM(EventCode=4104) OR TERM(EventCode=4105) OR TERM(EventCode=4106))
| stats count by host

The number of ComputerName values for the same time period is 41,656, which may be less simply due to the addition of new logs to the indexers for that time period before my searches above were run. Ironically, it took less time than my search on the indexed field "host" and I don't understand that either: 375s vs 430s, respectively.

Tags (1)

woodcock
Esteemed Legend

That is totally wrong. You should open a support case for sure.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...