Dashboards & Visualizations

timechart to show the number of total events before filtering and number of filtered events

splunkbeginner
Engager

the search is like this:
host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi)

how can I create a timechart to show the number of total events (host=linux01 sourcetype="linux:audit") and the number of filtered events (host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi))?

thanks for any help!

Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
host=linux01 sourcetype="linux:audit"
| bin span=1d _time
| stats count as total count(eval(key="linux01_change" AND NOT comm IN (vi, rm, ls))) as filter by _time

but this is faster following:

| tstats count where host=linux01 sourcetype="linux:audit" by _time span=1d prestats=t
| timechart span=1d count as total
| appendcols [ search  host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls)
| timechat span=1d count as filter]

View solution in original post

0 Karma

to4kawa
Ultra Champion
host=linux01 sourcetype="linux:audit"
| bin span=1d _time
| stats count as total count(eval(key="linux01_change" AND NOT comm IN (vi, rm, ls))) as filter by _time

but this is faster following:

| tstats count where host=linux01 sourcetype="linux:audit" by _time span=1d prestats=t
| timechart span=1d count as total
| appendcols [ search  host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls)
| timechat span=1d count as filter]
0 Karma

splunkbeginner
Engager

@to4kawa

it really helps. thank you.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@splunkbeginner,

Try

host=linux01 sourcetype="linux:audit" key="linux01_change" 
|timechart count as total,count(eval(!(match(comm,"vi")))) as not_vi

References :
https://docs.splunk.com/Documentation/Splunk/latest/Search/Usestatswithevalexpressionsandfunctions
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions

Happy Splunking!
0 Karma

splunkbeginner
Engager

thx renjith.nair,

sorry for some missing info. The base search shall be:
host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls)

and the the number of total events wanted is (host=linux01 sourcetype="linux:audit"), not (host=linux01 sourcetype="linux:audit" key="linux01_change")

the number of filtered events wanted is host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls)

i want the search to become sth like this:
host=linux01 sourcetype="linux:audit" | timechart count(host=linux01 sourcetype="linux:audit") as Total, count( host=linux01 sourcetype="linux:audit" key="linux01_change" NOT comm IN (vi, rm, ls) ) as Filtered

could you fine tune the search? much appreciated.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@splunkbeginner,

Try

host=linux01 sourcetype="linux:audit" |eventstats count as TOTAL
|search key="linux01_change" NOT comm IN (vi, rm, ls) 
|stats max(TOTAL) as Total,count as filtered count
Happy Splunking!
0 Karma

splunkbeginner
Engager

@renjith.nair,

much appreciated. there are some output.

if I want to use a timechart to show number of TOTAL and number of Filtered each day, the search will be like?

host=linux01 sourcetype="linux:audit" |eventstats count as TOTAL
|search key="linux01_change" NOT comm IN (vi, rm, ls)
|timechart span=1d TOTAL and filter???

Sorry for the trivial question again

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...