https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167353#M47646 <P>This is a very cool chart. thanks so much @diogofgm this was more than I was hoping for. Every Splunk Admin should have this chart to show growth and assimilation. Resistance is futile <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 12 Aug 2015 15:43:55 GMT hartfoml 2015-08-12T15:43:55Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167350#M47643 <P>I want to draw a chart of hosts added over time so that I can see at the beginning zero hosts and at the end 3,685 hosts. I would like to do this using the <CODE>firstTime</CODE> field from <CODE>| metadata type=hosts</CODE></P> <P>I have this search <CODE>| metadata type=hosts | eval Date=strftime(firstTime,"%Y-%m-%d") | fields host Date</CODE> but it is just a search of number of hosts added each day and not progressive over time.</P> <P>I have this search <CODE>index=_internal hostname="*" component="Metrics" | timechart span=d dc(hostname)</CODE> from Answers, but it is using the metrics logs and takes too long over a large number of days.</P> <P>I would like a <CODE>count to date</CODE> from the beginning for each day of my search.<BR /><BR /> Like <BR /> (day 1 count = 5) <BR /> (day 2 count = 5 + day1) <BR /> (day 3 count = 5 + day2) <BR /> and on an on.</P> <P>Thanks for any help.</P> Wed, 12 Aug 2015 15:12:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167350#M47643 hartfoml 2015-08-12T15:12:39Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167351#M47644 <P>Use streamstats:</P> <PRE><CODE>| metadata type=hosts | eval date=strftime(firstTime,"%Y-%m-%d") | fields host date | chart count(host) AS new_hosts over date | streamstats sum(new_hosts) AS total_hosts </CODE></PRE> Wed, 12 Aug 2015 15:27:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167351#M47644 diogofgm 2015-08-12T15:27:46Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167352#M47645 <P>This should do the trick.</P> <PRE><CODE>| metadata type=hosts index=*| eval _time=firstTime | fields _time host | timechart span=1d dc(host) as Hosts | makecontinuous | eval Hosts=coalesce(Hosts,0) | accum Hosts </CODE></PRE> Wed, 12 Aug 2015 15:31:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167352#M47645 somesoni2 2015-08-12T15:31:48Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167353#M47646 <P>This is a very cool chart. thanks so much @diogofgm this was more than I was hoping for. Every Splunk Admin should have this chart to show growth and assimilation. Resistance is futile <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 12 Aug 2015 15:43:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167353#M47646 hartfoml 2015-08-12T15:43:55Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167354#M47647 <P>This did a great job and I am still struggling to understand the code but it had a very different result than the search above. Thanks so much for your contribution it is a great learning code for me to try on something else. Thanks Again for the help.</P> Wed, 12 Aug 2015 15:45:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167354#M47647 hartfoml 2015-08-12T15:45:34Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167355#M47648 <P>Hi somesoni2,</P> <P>Using your query is it possible to get the hosts name as well?</P> <P>We want to know which hosts were added in the last 7 days , a report to be generated weekly once which gives us the list of hosts which were added in the last 7 days.</P> <P>Thanks in Advance</P> Tue, 20 Dec 2016 06:45:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-progressive-chart-of-hosts-added-over-time-using/m-p/167355#M47648 kiran_mh 2016-12-20T06:45:40Z