topic How to create a single value timechart after stats? in Splunk Search

How to create a single value timechart after stats?

alc2019 — Wed, 13 Mar 2019 19:25:12 GMT

Hi,

I'm doing a device count based on device latest time event registration. I'm getting the correct device registration count here on a single value (ex. 1000 count) filed but with no trending:

index.... ... earliest=-1mon
| stats count latest(_time) as last_update by device_name EventType
| search EventType="Registered"
| stats count(device_name) as Device_Count by last_update

I would like create a single value visualization to show trend of device registration compared to 2 weeks ago count. I tried the following but I'm not getting the same count as my device registration.

index.... ... earliest=-1mon
| stats count latest(_time) as last_update by device_name EventType _time
| search EventType="Registered"
| stats count(device_name) as Device_Count by last_update
| timechart span=2w count(Device_Count)

How can I fix this to show trend of the correct count of registered devices compared to 2-weeks ago?

Re: How to create a single value timechart after stats?

renjith_nair — Thu, 14 Mar 2019 10:56:00 GMT

@alc2019,

Try

 index.... ... earliest=-1mon EventType="Registered"
 | timechart span=2w count(device_name) as device_count

Re: How to create a single value timechart after stats?

alc2019 — Thu, 14 Mar 2019 14:34:31 GMT

Hi Renjith,

Thanks for the help but it will not work on my case as those devices register multiple times in a day and I have to count the registration based on their latest registration time.

Thanks

Re: How to create a single value timechart after stats?

renjith_nair — Thu, 14 Mar 2019 14:39:20 GMT

@alc2019,
What about

      index.... ... earliest=-1mon EventType="Registered"
     |stats latest(_time) as _time by device_name
      | timechart span=2w count(device_name) as device_count

Re: How to create a single value timechart after stats?

alc2019 — Fri, 15 Mar 2019 03:40:25 GMT

Perfect - works!

Thank you