Dashboards & Visualizations

It is possible to create a timechart per every single device?

ViniciusMariano
Explorer

Hello everyone,

I'm introducing in splunk, and I have a question about Timecharts, it is possible to create a timechart per every single device?

For example, I created a timechart with this:

| datamodel release_management_info flat
| search Location=* AND Model=*
| timechart span=month distinct_count(Name) by Category

But this doesn't cover all devices as some of them haven't created events in a few months.

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

No. Splunk search has its range. So if you're searching "from last thursday till today", Splunk will not return events from two months ago. It's simply not in the scope of the search. And how would Splunk know that there are supposed to be events from some source? It's not in the index so it's not found. Hence the lookup trick in the article which @richgalloway pointed you to.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If a device has not created an event within the search window then Splunk will not find the device and timechart cannot display it.  Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.

ViniciusMariano
Explorer

But, is there any way to do this condition?: if there is no event from this device this month, take an event from last month and get all data from this month as a copy, using eval with tstats

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To know what devices are missing, Splunk needs a list of known device names.  It will not seek names out automatically.  That is why the linked article uses a lookup table.  You also could use another search to collect the names.

<<your current search that produces a 'deviceName' field>> 
| eval found = 1
| append [ index=foo earliest=-2mon latest=-1mon 
  | fields + deviceName
  | dedup deviceName
]
| stats values(*) as * by deviceName
| where found == 1
---
If this reply helps you, Karma would be appreciated.

PickleRick
SplunkTrust
SplunkTrust

No. Splunk search has its range. So if you're searching "from last thursday till today", Splunk will not return events from two months ago. It's simply not in the scope of the search. And how would Splunk know that there are supposed to be events from some source? It's not in the index so it's not found. Hence the lookup trick in the article which @richgalloway pointed you to.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...