Splunk Search

Chart results of a report on a line chart

GenericSplunkUs
Path Finder

I've looked into Summary Indexing and I'm not sure that's what I'm looking for here.

I have a scheduled report that runs every day and just gives me the number of unique systems in an index for the last 30 days. I want to be able to take the results of this report from each day and chart that on a line chart. So I can see trending of numbers for enrolled systems better. So I'll get the daily result of the rolling 30 day search plotted on the graph.

Thanks,

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Summary indexing will do that, although there are probably other ways as well.

Modify your existing daily scheduled report to include a collect command to save its results in a summary index. Then you can create a report or dashboard that reads each day's results from the summary index. For example, if you write results to a summary index called 'dailySystemCount' then the report might look something like index = dailySystemCount | timechart span=1d values(count).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Summary indexing will do that, although there are probably other ways as well.

Modify your existing daily scheduled report to include a collect command to save its results in a summary index. Then you can create a report or dashboard that reads each day's results from the summary index. For example, if you write results to a summary index called 'dailySystemCount' then the report might look something like index = dailySystemCount | timechart span=1d values(count).

---
If this reply helps you, Karma would be appreciated.

GenericSplunkUs
Path Finder

Okay, I wasn't sure if this was a good application for that since I'm not looking in TONS of data.

Thanks,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...