topic Chart results of a report on a line chart in Splunk Search

Chart results of a report on a line chart

GenericSplunkUs — Wed, 16 Aug 2017 19:51:50 GMT

I've looked into Summary Indexing and I'm not sure that's what I'm looking for here.

I have a scheduled report that runs every day and just gives me the number of unique systems in an index for the last 30 days. I want to be able to take the results of this report from each day and chart that on a line chart. So I can see trending of numbers for enrolled systems better. So I'll get the daily result of the rolling 30 day search plotted on the graph.

Thanks,

Re: Chart results of a report on a line chart

richgalloway — Wed, 16 Aug 2017 20:39:27 GMT

Summary indexing will do that, although there are probably other ways as well.

Modify your existing daily scheduled report to include a collect command to save its results in a summary index. Then you can create a report or dashboard that reads each day's results from the summary index. For example, if you write results to a summary index called 'dailySystemCount' then the report might look something like index = dailySystemCount | timechart span=1d values(count).

Re: Chart results of a report on a line chart

GenericSplunkUs — Wed, 16 Aug 2017 20:47:06 GMT

Okay, I wasn't sure if this was a good application for that since I'm not looking in TONS of data.

Thanks,