Splunk Search

Path Finder

Hi,

I got a timechart that shows the number of critical package losses per day. Additionally I calculate the average of critical package losses within the chosen timespan and show it as a straight line in the timechart. Now I would like to add a line, that tells me, how many different hosts were used on every single day. (E.g Monday 36, Tuesday 64, Wednesday 55, ...)

Thats the code that calculates the number of critical package losses per day and the average within the chosen timespan.

``````| eval Amount= numberLostPackages
| timechart span=24h count(Amount) as Count sum(Amount) as Total aligntime=@d
| eventstats sum(Count) as TotalCount
| eval Duration=(info_max_time-info_min_time)/86400
| eval Average=TotalCount/Duration``````

Labels (2)

• ### timechart

1 Solution
Explorer

Using the distinct_count() function in your timechart will give you the number of different hosts each day.  so your search would look like this:

``````| eval Amount= numberLostPackages
| timechart span=24h count(Amount) as Count sum(Amount) as Total distinct_count(host) as unique_hosts aligntime=@d
| eventstats sum(Count) as TotalCount
| eval Duration=(info_max_time-info_min_time)/86400
| eval Average=TotalCount/Duration``````

Additionally, you can modify the span to align on days instead of hours which would allow for you to drop the aligntime from your timechart.  so the final search would look like this:

``````| eval Amount= numberLostPackages
| timechart span=1d count(Amount) as Count sum(Amount) as Total distinct_count(host)
| eventstats sum(Count) as TotalCount
| eval Duration=(info_max_time-info_min_time)/86400
| eval Average=TotalCount/Duration``````

Hope that helps.

Explorer

Using the distinct_count() function in your timechart will give you the number of different hosts each day.  so your search would look like this:

``````| eval Amount= numberLostPackages
| timechart span=24h count(Amount) as Count sum(Amount) as Total distinct_count(host) as unique_hosts aligntime=@d
| eventstats sum(Count) as TotalCount
| eval Duration=(info_max_time-info_min_time)/86400
| eval Average=TotalCount/Duration``````

Additionally, you can modify the span to align on days instead of hours which would allow for you to drop the aligntime from your timechart.  so the final search would look like this:

``````| eval Amount= numberLostPackages
| timechart span=1d count(Amount) as Count sum(Amount) as Total distinct_count(host)
| eventstats sum(Count) as TotalCount