topic Re: How to write a conditional timechart search that will not count more than 1 event per day? in Splunk Search

How to write a conditional timechart search that will not count more than 1 event per day?

splunkrsherman — Tue, 23 Jun 2015 00:03:58 GMT

I'd like an efficient search that will return either "Yes" or "No" for a timechart per day. I would imagine a limiting function and some evaluation may be necessary. I'm trying to avoid having splunk chew through counting more than 1 log record per day to simply confirm logs were simply present for that condition in the day.

I would imagine the search would like:

base search | timechart span=1d limit 1 as count | eval if(count > 0), "Yes", "No"

Re: How to write a conditional timechart search that will not count more than 1 event per day?

woodcock — Tue, 23 Jun 2015 01:02:59 GMT

Like this:

Index=* | dedup date_month date_mday host sourcetype | timechart span=1d | where count=0

This will show you sources of data that have not reported events in any full day, the most efficient way.

Re: How to write a conditional timechart search that will not count more than 1 event per day?

splunkrsherman — Wed, 24 Jun 2015 22:03:52 GMT

Thanks woodcock, this is useful and where a report is empty it indicates there were no days with 0 logs. Is there a way to inversely have a record for each day at least 1 log was present? For instance, a "Yes" for each day during the time period at least 1 log event matches the search string.

Re: How to write a conditional timechart search that will not count more than 1 event per day?

woodcock — Fri, 26 Jun 2015 13:21:56 GMT

Try this:

index=* | dedup date_month date_mday host sourcetype | timechart span=1d | eval OK=if(count=0,"NO","YES")

Don't forget to "Accept" the answer.

Re: How to write a conditional timechart search that will not count more than 1 event per day?

splunkrsherman — Fri, 26 Jun 2015 17:24:54 GMT

woodcock, thanks for your continued response.

Seems like the right track, but timechart will not work for me without supplying a field to chart by, I'm guessing I should use count. When I do that it dedups and rolls all into the most recent date/time with a count of days (7 for a week).