Getting Data In

Stricter search gives me more results...what?

rlough
Path Finder

I have a query that looks like this

index=*ind* ((source=*src1.log field=NAME) OR (source=*src1.log field=STRING)) | eventstats count(eval(field=="NAME")) AS f1 count(eval(field=="STRING")) AS f2 by users | where f1 < 1 AND f2 > 0 | dedup users | table users

The above returns something like 2000 statistics, but when I remove AND f2 > 0 and query along the exact same timeframe I get around 100 less statistics.

Why would making a search stricter ever return more results? This doesn't make sense.

Tags (2)
0 Karma
1 Solution

hortonew
Builder

I think it might be treating that as a single expression rather than two separate expressions.

Either try: where (f1 < 1) AND (f2 > 0)
or
where f1 < 1 | where f2 > 0

and see what the results look like

View solution in original post

hortonew
Builder

I think it might be treating that as a single expression rather than two separate expressions.

Either try: where (f1 < 1) AND (f2 > 0)
or
where f1 < 1 | where f2 > 0

and see what the results look like

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...