Splunk Search

Path Finder

Hi,

I got a timechart that shows the number of critical package losses per day. Additionally I calculate the average of critical package losses within the chosen timespan and show it as a straight line in the timechart. Now I would like to add a line, that tells me, how many different hosts were used on every single day. (E.g Monday 36, Tuesday 64, Wednesday 55, ...)

Thats the code that calculates the number of critical package losses per day and the average within the chosen timespan.

``````| eval Amount= numberLostPackages
| timechart span=24h count(Amount) as Count sum(Amount) as Total aligntime=@d
| eventstats sum(Count) as TotalCount
| eval Duration=(info_max_time-info_min_time)/86400
| eval Average=TotalCount/Duration``````

Labels (2)

• ### timechart

1 Solution
Explorer

Using the distinct_count() function in your timechart will give you the number of different hosts each day.  so your search would look like this:

``````| eval Amount= numberLostPackages
| timechart span=24h count(Amount) as Count sum(Amount) as Total distinct_count(host) as unique_hosts aligntime=@d
| eventstats sum(Count) as TotalCount
| eval Duration=(info_max_time-info_min_time)/86400
| eval Average=TotalCount/Duration``````

Additionally, you can modify the span to align on days instead of hours which would allow for you to drop the aligntime from your timechart.  so the final search would look like this:

``````| eval Amount= numberLostPackages
| timechart span=1d count(Amount) as Count sum(Amount) as Total distinct_count(host)
| eventstats sum(Count) as TotalCount
| eval Duration=(info_max_time-info_min_time)/86400
| eval Average=TotalCount/Duration``````

Hope that helps.

Explorer

Using the distinct_count() function in your timechart will give you the number of different hosts each day.  so your search would look like this:

``````| eval Amount= numberLostPackages
| timechart span=24h count(Amount) as Count sum(Amount) as Total distinct_count(host) as unique_hosts aligntime=@d
| eventstats sum(Count) as TotalCount
| eval Duration=(info_max_time-info_min_time)/86400
| eval Average=TotalCount/Duration``````

Additionally, you can modify the span to align on days instead of hours which would allow for you to drop the aligntime from your timechart.  so the final search would look like this:

``````| eval Amount= numberLostPackages
| timechart span=1d count(Amount) as Count sum(Amount) as Total distinct_count(host)
| eventstats sum(Count) as TotalCount
| eval Duration=(info_max_time-info_min_time)/86400
| eval Average=TotalCount/Duration``````

Hope that helps.

Get Updates on the Splunk Community!

#### NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

#### Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

#### Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...