Chart results of a report on a line chart

[GenericSplunkUs]

I've looked into Summary Indexing and I'm not sure that's what I'm looking for here.

I have a scheduled report that runs every day and just gives me the number of unique systems in an index for the last 30 days. I want to be able to take the results of this report from each day and chart that on a line chart. So I can see trending of numbers for enrolled systems better. So I'll get the daily result of the rolling 30 day search plotted on the graph.

Thanks,

[richgalloway · Accepted solution]

Summary indexing will do that, although there are probably other ways as well.

Modify your existing daily scheduled report to include a collect command to save its results in a summary index. Then you can create a report or dashboard that reads each day's results from the summary index. For example, if you write results to a summary index called 'dailySystemCount' then the report might look something like index = dailySystemCount | timechart span=1d values(count).

[GenericSplunkUs]

Okay, I wasn't sure if this was a good application for that since I'm not looking in TONS of data.

Thanks,