stats count by sourcetype,date_hour wrong results

[mauro_vaccari]

Hi all,

We have installed splunk 6.0.1.
when we try to use stats count by source type we have a results of all 8 sourcetype we have. If we combine sourcetype and date_hour we have a results of only two sourcetype

It's correct or some goes wrong?
This are search I'm using

earliest=-2h@h latest=@h | stats count by sourcetype

WinEventLog:Application 5269
WinEventLog:Security 2138
WinEventLog:System 345
WinEventLog:application 12408
WinEventLog:security 9347
WinEventLog:system 286
linux_messages 16066
vmw-esx 32392

earliest=-2h@h latest=@h | stats count by sourcetype,date_hour

linux_messages 14 6535
linux_messages 15 9536
vmw-esx 12 24669
vmw-esx 13 7723

Thanks

[martin_mueller · Accepted solution]

Those Windows sourcetypes probably don't have the field date_hour - that only exists if the timestamp is properly extracted from the event, I remember Windows sourcetypes might use indextime assignment instead. Try this as an alternative:

earliest=-2h@h latest=@h | bin span=1h _time | stats count by sourcetype _time

Slightly different point, but counting by sourcetype can be done much faster using tstats.

| tstats count by sourcetype _time span=1h

[mauro_vaccari]

Thanks, your search works perfectly, we try to use tstats. Thank you