Summary search count of events

[jtm7x2]

We have our dnsdebuglog turned on and I want to create a summary search of # of events in descending order. Results would look like this:

server 1 700,000

server 2 600,000

server 3 444,000

etc

Currently, we run a scheduled search every 24 hours (at midnight), but I would like to replace that with the summary search.

My attempts so far to make this work have resulted in there being approximately half as many events in the summary search as the scheduled search. Here is what I have:

Scheduled search (we only have 75 servers this applies to):
index="dns" sourcetype="dnsdebuglog" | top host limit=500

Summary search (run hourly):
index=dns sourcetype=dnsdebuglog | sistats count by host

Scheduled summary search:
index=summary search_name=summary_dnsdebuglog | stats count by orig_host | sort -count

What am I doing wrong?

[bmacias84]

I don't really see anything wrong with your seach try adding _time to sistats. Also try using the bucket command, it will allow you create a more accurate hour based summary. Try adding the follwing in your Summary search.

Summary search (run hourly):

index=dns sourcetype=dnsdebuglog | bucket span=1h _time| sistats count by _time, host

Scheduled summary search(I assume summary_dnsdebuglog is the name of your saved search):

index=summary search_name=summary_dnsdebuglog | stats count by orig_host | sort -count