Dashboards & Visualizations

Is there is a way to collect this data in a more efficient way?

JLopez
Explorer

Hi Splunk friends,

I'm using windows data for this example. 

I want to collect in a time range of last 7 days, the numbers of hosts from my windows index with a span of 1d

the result I am expecting is that every day I can see in a timechart the total numbers of host on each day increases of decreases

to do that I am using this search
index=<windows Index>    Computer=XYZ* | dedup Computer | timechart count(Computer) as count span=1d

The problem I am having is that the search never ends so only show a flat line and a peak from the last day. 
I have around1000 host. 

is there is a way to collect this data in a more efficient way? 

Thank in advance.

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @JLopez,

You can use below query;

| tstats dc(host) as count where index=<windows_index> host=XYZ* earliest=-7d by _time span=1d
If this reply helps you an upvote is appreciated.

View solution in original post

JLopez
Explorer

Thanks @scelikok 

it worked like a charm.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @JLopez,

You can use below query;

| tstats dc(host) as count where index=<windows_index> host=XYZ* earliest=-7d by _time span=1d
If this reply helps you an upvote is appreciated.
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...