Hi,
I wonder whether someone may be able to help me please.
I'm using the search below to successfully produce a given group of stats:
auditSource=ts auditType=RenewalStarted NOT [search auditSource=ts auditType=RenewalCompleted | table detail.nino] |
iplocation tags.clientIP |dedup detail.nino | fillnull value="Country Not Found" Country | stats count by Country
Because I know that the dedup
command can be resource intensive, I've tried changing this by using the stats dc
command as below:
auditSource=ts auditType=RenewalStarted NOT [search auditSource=ts auditType=RenewalCompleted | table detail.nino] |
iplocation tags.clientIP | fillnull value="Country Not Found" Country | stats dc(detail.nino) By Country
The problem I have is that although I'm using the same date period, the search is not returning the same set of results.
I just wondered whether someone may be able to look at this please and offer some guidance on where I may have gone wrong.
Many thanks and kind regards
Chris
Hi thank you for coming back to me. When I omit the fillnull from the second query the number of events are still greater than the initial query and the count significantly reduced.
However If I changed the latter query to auditSource=tc auditType=TCStarted NOT [search auditSource=tc auditType=TCCompleted | table detail.nino] | iplocation tags.clientIP | fillnull value="Country Not Found" | stats dc(detail.nino) By Country
which is now working perfectly.
Kind regards
Chris
Hi thank you for coming back to me. When I omit the fillnull from the second query the number of events are still greater than the initial query and the count significantly reduced.
However If I changed the latter query to auditSource=tc auditType=TCStarted NOT [search auditSource=tc auditType=TCCompleted | table detail.nino] | iplocation tags.clientIP | fillnull value="Country Not Found" | stats dc(detail.nino) By Country
which is now working perfectly.
Kind regards
Chris
Is it the same without the fillnull
command?