Dashboards & Visualizations

Get a Single value for count of hosts for tstats query

neerajs_81
Builder

Hi, i have a requirement to create single value visual with trendline.  I have looked at sample queries on Dashboard studio examples hub.  Below is my base query.  

 

 

 

|tstats dc(host) as distinct_count where index=okta
sourcetype="OktaIM2:log"

 

Expected result:  Something like this

neerajs_81_0-1723617908025.png

I have been trying below 2 searches but neither of two is showing the expected result. 

 

|tstats dc(host) as distinct_host where index=okta sourcetype="OktaIM2:log"
| chart count(distinct_host) by _time
OR
|tstats dc(host) as distinct_host where index=okta sourcetype="OktaIM2:log"
| timechart count(distinct_host) by _time

 

If i try the below query without tstats,  it works but i need to use tstats from a performance point of view.

 

 

index=okta sourcetype="OktaIM2:log"
| chart dc(host) by _time span=1h

 

Any suggestion how to generate single value trendline with tstats?

 

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If you want any sort of stat based on time, you should include it in the by clause. Try starting with something like this

|tstats dc(host) as distinct_host where index=okta sourcetype="OktaIM2:log" by _time

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you want any sort of stat based on time, you should include it in the by clause. Try starting with something like this

|tstats dc(host) as distinct_host where index=okta sourcetype="OktaIM2:log" by _time
0 Karma

neerajs_81
Builder

Thanks, didn't realize we could do a by clause with tstats as well.

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...