Sme search with same slot time doesnt returns same number of events

[jip31]

Hi
I have something strange
when I execute the search below, I have 47 events on a one week slot time

eventtype="AppliService" AND (NOT host=E* AND NOT host=I*) Name="MBAMAgent"  State="Stopped" 
| dedup host 
| table _time host DisplayName Name Started State

when I execute the search below on the same slot time, I have only 4 events for MBAMAgent

**eventtype="AppliService" AND (NOT host=E* AND NOT host=I***) (Name="dot3svc" OR Name="WlanSvc" OR Name="Winmgmt" OR Name="LanWlanSwitchingService" OR Name="PCServicesWinSrv" OR Name="CcmExec" OR Name="vpnagent" OR Name="wuauserv"OR Name="RCAgentMgr" OR Name="W32Time" OR **Name="MBAMAgent"** OR Name="BDESVC" OR Name="mfevtp" OR Name="mfemms" OR Name="McAfeeFramework" ) **State="Stopped"** 
| dedup host 
| table _time host DisplayName Name Started State

How is it possible because I use the same searc fields?
Thanks for your help

[cvssravan · Accepted solution]

That could be because for the same host, there might be multiple Name values. Dedup returns only the latest. So, In order to get the same count for Name=MBAMAgent, you need to add the Name field to dedup command

eventtype="AppliService" AND (NOT host=E* AND NOT host=I*) (Name="dot3svc" OR Name="WlanSvc" OR Name="Winmgmt" OR Name="LanWlanSwitchingService" OR Name="PCServicesWinSrv" OR Name="CcmExec" OR Name="vpnagent" OR Name="wuauserv" OR Name="RCAgentMgr" OR Name="W32Time" OR Name="MBAMAgent" OR Name="BDESVC" OR Name="mfevtp" OR Name="mfemms" OR Name="McAfeeFramework" ) State="Stopped"
| dedup host Name
| table _time host DisplayName Name Started State

[jip31]

yes it was the issue....... thanks a lot

[chrisyounger]

Wierd.

Are the extra "*" from trying to making things bold on the forums?

Is it becuase there is no space here: Name="wuauserv"OR

Can you use the job inspector >Search log and compare the lispy?

[jip31]

Ohhhhhhhh.... thanks!