Running total for events and unique users on dashboard

[sc0tt]

I would like to track the total number of events and unique users for today on a dashboard. What is the best way to do this? I know that I can simply do

| stats c as event_count dc(user) as user_count

but that would require having to scan the source and recount every couple minutes.

One idea I had was to save the results to a lookup table or use loadjob to get the totals and list of users from the previous search and then add/distinct count with the most recent search to get the new total.

Is there another way to accomplish this?

Thanks

[MuS · Accepted solution]

Hi sc0tt

if I get you correct, you want something similar to the summary view of the Search App?

There you also get running numbers of indexed events. If this is what you want, you can look at the view called dashboard or go to Manager» User interface» Views» dashboard

In the XML of the dashboard you can see this is done with a real-time search.

Hope I get you right and this example keeps you going.....

cheers, MuS

[sc0tt]

Thanks again! This is a good start.

[MuS]

sure you can use 'earliest=rt-0d@d latest=rt' in the 'time range picker - custome time - advanced search language' for your search

[sc0tt]

Thanks. I never thought of looking at the summary view of the search app. However, I am still a bit confused on how to accomplish this. It looks like the search app is using a real-time search for all time. Is there a way to do a real-time search for just the current day?