Is there is a way to collect this data in a more efficient way?

JLopez — Wed, 01 Feb 2023 16:49:34 GMT

Hi Splunk friends,

I'm using windows data for this example.

I want to collect in a time range of last 7 days, the numbers of hosts from my windows index with a span of 1d

the result I am expecting is that every day I can see in a timechart the total numbers of host on each day increases of decreases

to do that I am using this search
index=<windows Index> Computer=XYZ* | dedup Computer | timechart count(Computer) as count span=1d

The problem I am having is that the search never ends so only show a flat line and a peak from the last day.
I have around1000 host.

is there is a way to collect this data in a more efficient way?

Thank in advance.

Re: Help with timechart command efficiency

scelikok — Wed, 01 Feb 2023 10:48:56 GMT

Hi @JLopez,

You can use below query;

| tstats dc(host) as count where index=<windows_index> host=XYZ* earliest=-7d by _time span=1d

Re: Help with timechart command efficiency

JLopez — Wed, 01 Feb 2023 11:10:44 GMT

Thanks @scelikok

it worked like a charm.

topic Re: Help with timechart command efficiency in Dashboards & Visualizations

Is there is a way to collect this data in a more efficient way?

Re: Help with timechart command efficiency

Re: Help with timechart command efficiency