Splunk Search

Count per minute over 7 day period, graphed

pontorito
Explorer

I am trying to graph distinct count per minute over a 7-day period. I have a search that will give me the correct results, but when I graph the results, they are truncated. I understand splunk will only plot a max number of points, but is there any way I can "squeeze" the visualization to show me a 7-day period and still give me the granularity of 1-minute aggregations so I can see peaks and lows within each day? I am using Hunk.

This is the current search I am using:

index = myIndex eventName
| timechart span=1m dc(myField) by myType

thx for the help!

0 Karma

somesoni2
Revered Legend

Try this

  index = myIndex eventName |bucket span=1m _time | stats dc(myField) as uniqueMyField by myType, _time | timechart span=10m avg(uniqueMyField) as uniqueMyField by myType 

somesoni2
Revered Legend

Great. If there are no followup question around the same, please accept the answer and close the question.

0 Karma

pontorito
Explorer

Interesting workaround using 10m span and for now, I think this is the only way to get the info I need on the graph! Because of number of events, I had to increase span to 1h but I can still see the trend. Thanks!

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...