Have a search that gives data, for "yesterday" with specific criteria. Trying to show results by Location, with counts by user per location. I get the counts, but it sometimes does not show a count.
Search is this. (data changed to protect the innocent 🙂 )
index=location |search LockedStatus=Locked |rename UserAccountEntry as User |stats count by Location User | stats values(User) as User values(count) as PerUser_count sum(count) as Total by Location | sort 10 -Total
If you look at DEF, for the 1258452 there is not a 1 in the per user count. Thoughts on why? (this happens every day, though location or user is different).
Thanks
values
has an implicit dedup. Since both counts are 1, its gets deduped. Try using list
instead.
index=location |search LockedStatus=Locked |rename UserAccountEntry as User |stats count by Location User | stats list(User) as User list(count) as PerUser_count sum(count) as Total by Location | sort 10 -Total
values
has an implicit dedup. Since both counts are 1, its gets deduped. Try using list
instead.
index=location |search LockedStatus=Locked |rename UserAccountEntry as User |stats count by Location User | stats list(User) as User list(count) as PerUser_count sum(count) as Total by Location | sort 10 -Total