How to keep the results for each day from a daily scheduled search on dashboard for the last 1 month?

[chandra61446]

How to keep everyday search result on dashboard?
e.g. I need a search to run daily on 00:01 Hours everyday and display it on dashboard, but when it runs on the next day, it should produce a column with the current date and keep the column of the previous date result as well. I would like this dashboard to maintain the search result history for the last 1 month.

Any Ideas, how to do that?

[ctaf]

You could use the Timewrap command: https://splunkbase.splunk.com/app/1645/

| timechart count span=1h | timewrap d |

It allows you to compare days to days or weeks to weeks very easily

[renjith_nair · Accepted solution]

Try summary indexing. Run your search everyday and store only the results you want in summary index. Use the summary index in dashboard. This will speed up your dashboard especially if you have to search for one month data

http://docs.splunk.com/Documentation/Splunk/6.3.1511/Knowledge/Usesummaryindexing

[thirumalreddyb]

If your number of results are less then,

your search query.... | append [|inputlookup RESULTS.csv | eval epoch_date=strptime(date,"%Y-%m-%d") (or whatever the format) | where epoch_date>=now-(30*86400) ]outputlookup RESULTS.csv

Now schedule this search to run at 00:01 hours everyday and use the RESULTS.csv to power your dashboard.

P.S: Accept the answer if it is useful.