https://community.splunk.com/t5/Splunk-Search/trend-data-from-saved-search/m-p/163859#M46558 <P>What you want is a summary index. Run your daily saved search of the last 24 hours and save the 4 values to a summary index. Then you can search the SI for your trend. See <A href="http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Usesummaryindexing">http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Usesummaryindexing</A>.</P> Wed, 14 May 2014 14:25:57 GMT richgalloway 2014-05-14T14:25:57Z https://community.splunk.com/t5/Splunk-Search/trend-data-from-saved-search/m-p/163858#M46557 <P>I have a saved search that looks at the previous 24 hours of data and pulls back a simple table with 4 values. Similar to below.</P> <PRE><CODE>index=data profile_name="Workstations" | dedup src_ip | rangemap field=score Low=0-100,Medium=101-500,High=501-1000,Critical=1001-999999 | top limit=0 range </CODE></PRE> <P>What i would like to do is to be able to see the trend of these values over time (3+ years) without having to query the 3 years worth of data.</P> <P>My thought was to write the data to a lookup table each night with the date. Then, in a new search I could query that table to pull the trend over time. I'm having trouble finding a solution. <FYI> if it matters, I do not have CLI access.</FYI></P> <P>Thoughts? Thanks in advance</P> Wed, 14 May 2014 13:11:00 GMT https://community.splunk.com/t5/Splunk-Search/trend-data-from-saved-search/m-p/163858#M46557 jmiddle1977 2014-05-14T13:11:00Z https://community.splunk.com/t5/Splunk-Search/trend-data-from-saved-search/m-p/163859#M46558 <P>What you want is a summary index. Run your daily saved search of the last 24 hours and save the 4 values to a summary index. Then you can search the SI for your trend. See <A href="http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Usesummaryindexing">http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Usesummaryindexing</A>.</P> Wed, 14 May 2014 14:25:57 GMT https://community.splunk.com/t5/Splunk-Search/trend-data-from-saved-search/m-p/163859#M46558 richgalloway 2014-05-14T14:25:57Z