Dashboards & Visualizations

Is there is a way to collect this data in a more efficient way?

JLopez
Explorer

Hi Splunk friends,

I'm using windows data for this example. 

I want to collect in a time range of last 7 days, the numbers of hosts from my windows index with a span of 1d

the result I am expecting is that every day I can see in a timechart the total numbers of host on each day increases of decreases

to do that I am using this search
index=<windows Index>    Computer=XYZ* | dedup Computer | timechart count(Computer) as count span=1d

The problem I am having is that the search never ends so only show a flat line and a peak from the last day. 
I have around1000 host. 

is there is a way to collect this data in a more efficient way? 

Thank in advance.

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @JLopez,

You can use below query;

| tstats dc(host) as count where index=<windows_index> host=XYZ* earliest=-7d by _time span=1d
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

JLopez
Explorer

Thanks @scelikok 

it worked like a charm.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @JLopez,

You can use below query;

| tstats dc(host) as count where index=<windows_index> host=XYZ* earliest=-7d by _time span=1d
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...