topic Re: plotting unique values using timecharts in Splunk Search

plotting unique values using timecharts

chan2 — Tue, 19 Feb 2013 00:11:54 GMT

Hi,

I'd like to draw a quick chart of unique instances of a given field over time. Specifically, I'd like a chart with:
x-axis: time in increments of days or hours
y-axis: number of unique users as defined by the field 'userid'
So regardless of how many userids appear on a given day, the chart would only display a single line with the number of unique userids.

I tried the following query, but it does not provide the above:
* | timechart count by unique(userid)

A sample log event would be:
event userid=X

Re: plotting unique values using timecharts

yoho — Tue, 19 Feb 2013 03:00:51 GMT

Don't know enough about Splunk to tell you exactly what to do, but I would use summary indexes. You need in a field the value you're trying to plot and if I understand well, you don't have this value anywhere in your log files. So you should run a summary search every day or every hour which is counting the number of unique user ids since the previous time the summary search was run. Once you get this result, it will be easy to plot what you need.

To get your summary index, you will have to extract your "userid" field (with multikv ?) and then pipe this through the "uniq" command and count the results.

Hope that helps.

Re: plotting unique values using timecharts

jonuwz — Tue, 19 Feb 2013 08:26:21 GMT

You need

... | timechart span=1d dc(userid)

Where dc = distinct count.