topic Timechart with moving count in Splunk Search

Timechart with moving count

jrs42 — Mon, 18 Mar 2024 20:44:52 GMT

I'm trying to (efficiently) create a chart that collects a count of events, showing the count as a value spanning the previous 24h, over time. i.e. every bin shows the count for the previous 24h.

This is intended to show the evaluations an alert is making every x minutes where it triggers if the count is greater than some threshold value. I'm adding that threshold to the chart as a static line so we should be able to see the points at which the alert could have triggered.

I have the following right now, but it's only showing one data point per day when I would prefer the normal 100 bins

... | timechart span=1d count | eval threshold=1000

Hope that's not too poorly worded 🙂

Re: Timechart with moving count

isoutamo — Mon, 18 Mar 2024 21:24:52 GMT

I'm not sure if I understood your question correctly, but maybe you could get this done with streamstats?

You could use it first to calculate that sliding count for previous 24h and then use timechart with values/max to show those into your chart.

See https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/Streamstats use it with time_window=1d

... | streamstats time_window=1d count as dailyCount .... | timechart max(dailyCount) as dailyCount max(threshold) as threshold ...

Use span on timechart and any other aggregate values which you maybe need.

r. Ismo

Re: Timechart with moving count

jrs42 — Mon, 18 Mar 2024 21:55:00 GMT

Unfortunately, that's not it. Let me try to clarify 🙂

Right now, I get results with one value per day so if I pick "last 7 days" I only see 7 data points which is much too coarse. I'd prefer to have the normal "100 bins" or points of data, with each one the count of events for the preceding 24h from when that data point/bin is in time. The end result would be a much smoother chart, basically showing the count value my alert is checking.

It's looking to me that as soon as I pick "last 7 days", I'm in the realm of days and I cannot plot with more granularity.

Re: Timechart with moving count

PickleRick — Mon, 18 Mar 2024 22:39:46 GMT

That's what @isoutamo is talking about. This is what streamstats does. With properly set window (either in terms of number of events or time) it can calculate stats over moving window.