topic need value by time in Splunk Search

need value by time

splunkuseradmin — Wed, 15 May 2019 20:04:38 GMT

hello I have a command which gives the value ex., "172" it is basically change when no. of ldap users added and removed I need to get the value by time. where there is no logs generated by time or some thing like that its just a total number which we can see ...
-So the question is, is there any way we can get by time like if we run a dashboard we get these fields and count by week or something.

it basically gives the fields
Host.....User........count.......port
ccm.corp.exp.com......sideview-cdr........172.......8443

Re: need value by time

PowerPacked — Wed, 15 May 2019 23:58:24 GMT

are you looking timechart command, this will plot a chart for every time span.

yourquery | timechart span=1h count(yourfieldname)

change the span to others like 1m,5m,1h,1d etc

& take a look at this timechart command doc

https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Timechart

Thanks

Re: need value by time

splunkuseradmin — Wed, 22 May 2019 21:34:01 GMT

thank you for replying but timechart command is not working as there are no logs.
basically using api's to get values.

Re: need value by time

PowerPacked — Wed, 22 May 2019 22:02:12 GMT

It should return time field other wise you cant plot chart or not even know when that specific value happened or changed