https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365509#M107791 <P>You can add a parameter called limit in the timechart command which limits the number of columns generated.</P> <PRE><CODE>| timechart span=1d limit=50 count by TableName </CODE></PRE> Fri, 05 May 2017 19:27:54 GMT somesoni2 2017-05-05T19:27:54Z https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365505#M107787 <P>I have a job that runs and deletes data from a data base. After it deletes the data it outputs which days it deleted which table in a log of the form:</P> <PRE><CODE>**start of A** ODATE=2017-05-05 PurgeDate="2017-04-14,2017-04-15" TableName=A **start of B** ODATE=2017-05-05 PurgeDate="2017-04-10" TableName=B </CODE></PRE> <P>The file gets split into multple logs, one for each Table. How can I have a chart/table/dashboard that tells me the last X days that have been purged for each table?</P> Fri, 05 May 2017 18:33:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365505#M107787 Splunkster45 2017-05-05T18:33:50Z https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365506#M107788 <P>Give this a try</P> <PRE><CODE>your base search | makemv delim="," PurgeDate | mvexapnd PurgeDate | eval _time=strptime(PurgeDate,"%Y-%m-%d") | timechart span=1d count by TableName </CODE></PRE> Fri, 05 May 2017 18:54:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365506#M107788 somesoni2 2017-05-05T18:54:45Z https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365507#M107789 <PRE><CODE>your search here | stats values(PurgeDate) by TableName </CODE></PRE> <P>should show a table with each TableName and the dates that they have been purged</P> Fri, 05 May 2017 18:56:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365507#M107789 ckunath 2017-05-05T18:56:30Z https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365508#M107790 <P>This largely worked for me. However, after 10 results tables, it combined all of the other tables into the category "other." Is there a way to increase this limit?</P> Fri, 05 May 2017 19:22:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365508#M107790 Splunkster45 2017-05-05T19:22:18Z https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365509#M107791 <P>You can add a parameter called limit in the timechart command which limits the number of columns generated.</P> <PRE><CODE>| timechart span=1d limit=50 count by TableName </CODE></PRE> Fri, 05 May 2017 19:27:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365509#M107791 somesoni2 2017-05-05T19:27:54Z https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365510#M107792 <P>Hi Splunkster45,<BR /> To reach you goal you have to do some steps (probably someone of them already done)</P> <OL> <LI>ingest logs </LI> <LI>run a search</LI> </OL> <P><STRONG>1 ingest logs</STRONG><BR /> download an example of you file and find the correct sourcetype using the Splunk web interface<BR /> it should be something like this</P> <PRE><CODE>[your_sourcetype] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true BREAK_ONLY_BEFORE=\*\*start\sof\s\w+\*\* TIME_FORMAT=%Y-%m-%d TIME_PREFIX=ODATE\= MAX_TIMESTAMP_LOOKAHEAD=10 </CODE></PRE> <P><STRONG>2 run a search</STRONG><BR /> run a serch like the following example</P> <PRE><CODE>index=your_index sourcetype=your_sourcetype | makemv delim="," PurgeDate | table _time TableName PurgeDate </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Sat, 06 May 2017 09:28:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-if-an-event-runs-once-a-day/m-p/365510#M107792 gcusello 2017-05-06T09:28:19Z