Why does the timechart command give different values than stats command?

[umsundar2015]

Hi,

I am getting difference in count while using stats in piechart and with same search with timechart in line graph.

Can anyone help me with solution for this??

Regards,
Sundar

[DalJeanis]

Those results are unlikely to be from the same search.

Your pie chart has over 1.7 times as many results as your time chart, so the execution time difference of a few minutes is not the problem.

You have some additional criteria that is in place in one search that is not in the other, probably in terms of the aggregation. Just to eliminate any possiblity of that, though, you can add this to the beginning of your time chart search...

earliest=-7d@d latest =@d  (your search here)
| bin _time span=1d

...and add this to the beginning of your pie chart search...

earliest=-1d@d latest =@d  (your search here)
| bin _time span=1d

.. and the results will be forced to line up in the same 1-day bins.

[umsundar2015]

Thank you Daljeanis .

It worked perfectly .

[DalJeanis]

@umsundar2015 - Great! If that solved your issue, then please mark this answer as "accepted".

[woodcock]

We need BOTH search strings and also the timepicker details.

[gcusello]

hi umsundar2015,
did you used the same time period? try with a fixed period (e.g. yesterday) not "now" (e.g. last hour) because results are changing.
Bye.
Giuseppe

[umsundar2015]

No i used different time period Like last 24hrs for piechart and last 7 days for trending chart .

Please suggest me way to make it equal ..

[gcusello]

Th problem is that if you use a time period until "now" the two searches take a little different time period so you'll have different results.
You can test this situation using a different time condition: instead now use: until last hour (@h), so you can verify that results of the last 24 hours are the same of the last column of you time chart.

You could try use a post process search in you dashboartd so you'll have the same search in both the panels, putting the condition "last 24 hours" as a secondary search.

Bye.
giuseppe

[umsundar2015]

for pie chart i am using last 24 hours(total count is 5386) and trending chart i am using last 7 days and values are

_time Not Reporting Reporting
2017-04-18 1819 1400
2017-04-19 1819 1400
2017-04-20 1819 1400
2017-04-21 1819 1400
2017-04-22 1829 1400
2017-04-23 1829 1400
2017-04-24 1829 1400

can ypu suggest me a way to solve this issue ,