topic Re: timechart vs. streamstats in Splunk Search

timechart vs. streamstats

mctester — Sat, 25 Sep 2010 04:30:29 GMT

If I do this:

index="foo" sourcetype="bar" | sort _time | streamstats dc(userid) as dcusers | delta dcusers as deltadcusers

This gives me a 0 on the event if the user has been seen before, or 1 if the user is a new user.

But then if I:

| timechart sum(deltadcusers)

It starts out looking right, then progressively collects backwards until there is only one data point at the start containing the same value as stats dc(userid) for the whole time window.

If I leave out the sort _time, then the streamstats command gives values backwards from what I want - it streams backwards in time, I want it streamed forwards from the start of the day.

This doesn't seem right at all, how do I/can I get streamstats and timechart to interact in a sane way in this sort of scenario?

Re: timechart vs. streamstats

steveyz — Sat, 25 Sep 2010 04:54:18 GMT

so what does the output of

index="foo" sourcetype="bar" | sort _time | streamstats dc(userid) as dcusers | delta dcusers as deltadcusers | timechart sum(deltadcusers)

look like?

Seems like you want to get a chart of how many new users you are getting for each time span?

Re: timechart vs. streamstats

blilburne — Mon, 27 Sep 2010 07:22:46 GMT

Yes, I want to see how many "not seen before on this day" user IDs are coming online on an hourly basis through the day.

Without the sort, it appears to work correctly but the graph is backwards - i.e, the highest count for streamstats is at the start, which means all the deltas/dc values are backwards.

If I sort it, it appears to truncate the results - i.e, I will only see values for a fraction of the time span, and this does not make sense as there are events across the whole timespan, all have userids.

Basically I want streamstats to run forward in time the same way it does for an rtsearch.

Re: timechart vs. streamstats

blilburne — Tue, 28 Sep 2010 07:25:27 GMT

This appears to do what I want:

... | dedup userid sortby +_time | timechart count

This does not:

... | sort +_time | dedup userid | timechart count

Streamstats doesn't have a sortby so it appears not to be possible to do the same with streamstats (change the direction in which they are streamed).