topic Re: Graph of rolling totals in Splunk Search

Graph of rolling totals

andrewbeak — Wed, 16 May 2018 09:53:55 GMT

Hi,

I want to create a graph that shows calculated values by time.

Each value must be calculated as the number of unique users visiting the site for the three months prior to that date.

In order to try and limit the amount of work required I want to only show one value per week.

So the value for 1 May 2018 must be the number of unique users from 1 Feb to 1 May 2018. The value for 14 May must be the number of users from 14 Feb to 14 May.

I'm pretty sure that I need to use "eval", but I'm struggling to work out how to "eval the distinct count of user.id for three months from the current row _time"

Any ideas how to accomplish this?

Re: Graph of rolling totals

niketn — Wed, 16 May 2018 11:08:14 GMT

@andrewbeak do you want to create a chart from a table drilldown? What do you mean by for three months from the current row _time?

Also do you want previous three months or one month as per you sample data?

Earliest Time in the Time Picker will -1mon@d or -3mon@d based on last month or last 3 months as needed.

For creating weekly stats you can refer to one of my previous answers and adjust as per your needs: https://answers.splunk.com/answers/637244/time-range-to-display-count-of-weekly.html

Re: Graph of rolling totals

knielsen — Wed, 16 May 2018 11:13:18 GMT

I understood it like he wants to have a weekly rolling dc(user.id) over the last 3 months, so the time ranges always overlap. And if that's the case, I'd really go with a summary index, having a weekly search over the last 3 months. Easy to use, and depending on the amount of data a hell of lot faster to display in the end, when you just pull the precalculated results for each week.

Re: Graph of rolling totals

andrewbeak — Thu, 17 May 2018 10:51:13 GMT

Thanks, that is what I am trying to do. I hadn't considered a summary index but that's a really good idea and I'll try to include that.