topic Re: Count per minute over 7 day period, graphed in Splunk Search

Count per minute over 7 day period, graphed

pontorito — Mon, 09 Jun 2014 20:28:01 GMT

I am trying to graph distinct count per minute over a 7-day period. I have a search that will give me the correct results, but when I graph the results, they are truncated. I understand splunk will only plot a max number of points, but is there any way I can "squeeze" the visualization to show me a 7-day period and still give me the granularity of 1-minute aggregations so I can see peaks and lows within each day? I am using Hunk.

This is the current search I am using:

index = myIndex eventName
| timechart span=1m dc(myField) by myType

thx for the help!

Re: Count per minute over 7 day period, graphed

somesoni2 — Mon, 09 Jun 2014 20:43:17 GMT

Try this

  index = myIndex eventName |bucket span=1m _time | stats dc(myField) as uniqueMyField by myType, _time | timechart span=10m avg(uniqueMyField) as uniqueMyField by myType

Re: Count per minute over 7 day period, graphed

pontorito — Tue, 10 Jun 2014 14:20:37 GMT

Interesting workaround using 10m span and for now, I think this is the only way to get the info I need on the graph! Because of number of events, I had to increase span to 1h but I can still see the trend. Thanks!

Re: Count per minute over 7 day period, graphed

somesoni2 — Tue, 10 Jun 2014 15:51:24 GMT

Great. If there are no followup question around the same, please accept the answer and close the question.