Why is Log Analytics count() function reporting fewer records than count operator?

Question

I have the following query running in Log Analytics to count the (very large, into the millions!) number of exceptions that are being raised by my app:

exceptions
| where problemId has "KeyNotFoundException"
| count

however, if I change this to

exceptions
| where problemId has "KeyNotFoundException"
| summarize count()

the resulting count goes down, even though these exceptions are being created almost constantly (i.e the count going up would be explainable).

I can't find anything online about whether/why there is a difference between count and count(), other than the obvious difference that count is an operator on a set of records and count() is an aggregation function which must be run within a summarize context.

Can anyone explain the difference between the two approaches. Is summarize somehow working on an out-of-date set of records?

Answer 1

• As suggested by David ???? Markovitz and as mentioned by Rob Gilliam that issue got resolved. Posting the research over here to help the other community members who have similar kinds of issues.
• When we are trying to check any query in KQL, we should remember that the default time range will be set to 24 hours, and we can change that according to our requirement to get accurate data.