Splunk Search

Creating a bar chart with multiple fields

Engager

I am trying to create a bar chart displaying the amount of active users the past 1 hour, 24 hour, and 1 week.

How would I go about doing this?

Thanks!

0 Karma
1 Solution

Motivator

If you have the keywords to detect and filter out unique active users then you can follow below approach assuming field user identifies a user:

index= yourIndex earliest=-1h your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last1Hour"
| append [ search  index= yourIndex earliest=-24h your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last24Hour" ]
| append [ search index= yourIndex earliest=-7d your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last1Week" ]
| chart ActiveUser over reportKey

View solution in original post

Motivator

If you have the keywords to detect and filter out unique active users then you can follow below approach assuming field user identifies a user:

index= yourIndex earliest=-1h your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last1Hour"
| append [ search  index= yourIndex earliest=-24h your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last24Hour" ]
| append [ search index= yourIndex earliest=-7d your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last1Week" ]
| chart ActiveUser over reportKey

View solution in original post

SplunkTrust
SplunkTrust

Give this a try

Updated
Thanks @gokadroid for pointing out the flaw in the previous answer.

your base search earliest=-7d| eval Period=case(_time>=relative_time(now(),"-1h"),"1#Last 1 Hour"),_time>=relative_time(now(),"-24h"),"2#Last 24 Hour",1=1,"3#Last 1 Week") | stats count(UserField) as active_users by Period
| accum active_users | eval Period=mvindex(split(Period,"#"),1)

Motivator

Should not the last one hour users be also part of last 24 hours? and so shall be the last 24 hours part of last 7days? Just thinking!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!