Splunk Search
Highlighted

Creating a bar chart with multiple fields

Engager

I am trying to create a bar chart displaying the amount of active users the past 1 hour, 24 hour, and 1 week.

How would I go about doing this?

Thanks!

0 Karma
Highlighted

Re: Creating a bar chart with multiple fields

SplunkTrust
SplunkTrust

Give this a try

Updated
Thanks @gokadroid for pointing out the flaw in the previous answer.

your base search earliest=-7d| eval Period=case(_time>=relative_time(now(),"-1h"),"1#Last 1 Hour"),_time>=relative_time(now(),"-24h"),"2#Last 24 Hour",1=1,"3#Last 1 Week") | stats count(UserField) as active_users by Period
| accum active_users | eval Period=mvindex(split(Period,"#"),1)
Highlighted

Re: Creating a bar chart with multiple fields

Motivator

Should not the last one hour users be also part of last 24 hours? and so shall be the last 24 hours part of last 7days? Just thinking!

0 Karma
Highlighted

Re: Creating a bar chart with multiple fields

Motivator

If you have the keywords to detect and filter out unique active users then you can follow below approach assuming field user identifies a user:

index= yourIndex earliest=-1h your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last1Hour"
| append [ search  index= yourIndex earliest=-24h your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last24Hour" ]
| append [ search index= yourIndex earliest=-7d your query to return active user
| dedup user
| stats count as ActiveUser
| eval reportKey="Last1Week" ]
| chart ActiveUser over reportKey

View solution in original post