https://community.splunk.com/t5/Splunk-Search/dc-rolling-over-time/m-p/27794#M5434 <P>I think you'll be much happier using <CODE>streamstats</CODE> with it's <CODE>window</CODE> argument. </P> <P><CODE>index=httpd sourcetype=httpd-access | timechart dc(clientip) as dc span=1m | streamstats avg(dc) as rollingAvg window=5</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/streamstats">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/streamstats</A></P> Thu, 19 Apr 2012 06:28:44 GMT sideview 2012-04-19T06:28:44Z https://community.splunk.com/t5/Splunk-Search/dc-rolling-over-time/m-p/27793#M5433 <P>Looking at the results from a popular web analytic site, their definition of "current visitors" seems to be "distinct count over rolling five minutes". I'd like to replicate that in Splunk, but I couldn't find an elegant way to keep a rolling dc for five minute blocks without starting over. You could simply say <CODE>timechart span=5m dc(clientip)</CODE> but that's not quite the same thing, as I would like a bar per minute that represents the previous 5 minutes.</P> <P>I've come up with a query that works, but I'm hoping someone more clever than I can shorten this query a bit. Maybe there's a timechart function I'm missing, or a range function of some sort that would shorten the eval, or a weird use of streamstats:</P> <OL> <LI>index=httpd sourcetype=httpd-access </LI> <LI> | bucket span=1m _time </LI> <LI> | eval t=split( _time + "," + tostring(_time+60) + "," + tostring(_time+120) + "," + tostring(_time+180) + "," + tostring(_time+240) , "," ) </LI> <LI> | stats dc(clientip) as dc by t </LI> <LI> | where t&lt;now() </LI> <LI> | eval _time=t </LI> <LI> | timechart span=1m max(dc) as dc</LI> </OL> <P>Just to step through what it does... </P> <OL> <LI>Find the events.</LI> <LI>Floor _time of each event to the minute. </LI> <LI>Make a multivalued field t with _time and the next four minutes. </LI> <LI>Calculate the dc per minute. Since t is multivalued, each event will count towards its minute and the four minutes after it. </LI> <LI>Throw away the future minutes created on events in the last minute. </LI> <LI>Reset _time to t for the timechart. </LI> <LI>Chart it.</LI> </OL> Mon, 16 Apr 2012 20:11:28 GMT https://community.splunk.com/t5/Splunk-Search/dc-rolling-over-time/m-p/27793#M5433 vbumgarn 2012-04-16T20:11:28Z https://community.splunk.com/t5/Splunk-Search/dc-rolling-over-time/m-p/27794#M5434 <P>I think you'll be much happier using <CODE>streamstats</CODE> with it's <CODE>window</CODE> argument. </P> <P><CODE>index=httpd sourcetype=httpd-access | timechart dc(clientip) as dc span=1m | streamstats avg(dc) as rollingAvg window=5</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/streamstats">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/streamstats</A></P> Thu, 19 Apr 2012 06:28:44 GMT https://community.splunk.com/t5/Splunk-Search/dc-rolling-over-time/m-p/27794#M5434 sideview 2012-04-19T06:28:44Z https://community.splunk.com/t5/Splunk-Search/dc-rolling-over-time/m-p/27795#M5435 <P>I don't think that will give the same answer. After the timechart, you have a dc per minute, but you've lost what the dc for groupings of five minutes would have been.</P> <P>I wonder if this would be more efficient...</P> <PRE><CODE>index=httpd sourcetype=httpd-access | timechart span=1m values(clientip) as ips | streamstats dc(ips) as dc window=5 | fields - ips </CODE></PRE> Fri, 20 Apr 2012 02:25:09 GMT https://community.splunk.com/t5/Splunk-Search/dc-rolling-over-time/m-p/27795#M5435 vbumgarn 2012-04-20T02:25:09Z