topic Re: Inefficient Query - Same Base Query, Multiple Time Ranges earliest -24h, -30d, -60d in Splunk Search

Inefficient Query - Same Base Query, Multiple Time Ranges earliest -24h, -30d, -60d

splunkyj — Mon, 14 Dec 2020 20:50:05 GMT

I need some suggestions on how to make this query more efficient. We would like distinct count of workstation by sitename - with 3 columns of the count that shows within the past 24 hours, 30 days, and 60 days.

index=sample sourcetype="SAMPLE:DATA" earliest=-24h

| stats dc(workstation_name) AS "Past 24 Hours EUD Count" by sitename

| appendcols

[ search index=sample sourcetype="SAMPLE:DATA" earliest=-30d

| stats dc(workstation_name) AS "Past 30 Days EUD Count" by sitename ]

| appendcols

[ search index=sample sourcetype="SAMPLE:DATA" earliest=-60d

| stats dc(workstation_name) AS "Past 60 Days EUD Count" by sitename ]

| appendcols

[ search index=sample sourcetype="SAMPLE:DATA" earliest=-90d

| stats dc(workstation_name) AS "Past 90 Days EUD Count" by sitename ]

Re: Inefficient Query - Same Base Query, Multiple Time Ranges earliest -24h, -30d, -60d

nickhills — Mon, 14 Dec 2020 21:57:18 GMT

Try something like this

index=sample sourcetype="SAMPLE:DATA" earliest=-90d@d latest=@d | bin _time span=1d | eval timeframe=case(_time<relative_time(now(), "-60d@d"), "90d", _time>relative_time(now(), "-60d@d") AND _time<relative_time(now(), "-30d@d"), "60d", _time>relative_time(now(), "-30d@d"), "30d", 1=1, "Other") | stats dc(workstation_name) as EUD by timeframe, sitename

Re: Inefficient Query - Same Base Query, Multiple Time Ranges earliest -24h, -30d, -60d

splunkyj — Tue, 15 Dec 2020 00:05:13 GMT

Hi @nickhills , I would like to see the different count of time ranges in it's own column by sitename. First column sitename, 2nd column count of the past 24 hours, 3rd column count of the past 30 days, 4th column count of the past 60 days, and 5th column count of the past 90 days. Thanks for your suggestion, I tried playing around with it - but I couldn't get the results I'm looking for. Let me know if you have another suggestion, I truly appreciate it.