In an running a command which uses the `dedup` command:
index=myindex earliest=-5d@d latest=@d |
bin _time span=1d |
dedup id, _time | stats count
The above query returns 794.
However, if I add a `table` command **before** dedup:
index=myindex earliest=-5d@d latest=@d |
bin _time span=1d |
table id, _time | dedup id, _time | stats count
The result is **798**! This really puzzles me as I don't expect the table command will change my answer. Am I missing something? Or is it a bug?
↧