Splunk Search

Distinct Events Days in Index

fredclown
Path Finder

I'm trying to write an efficient search to find out the distinct days of events that I have in an index. Basically, I want to be able to see if I am missing data for any days. I could pipe the date in mm/dd/yyyy format to a table and then use dedup, but that is SLOW and my hunch is there is a better and faster way to do it.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this one. decent performance.

index=yourindex| stats first(_time) as _time by date_mday | convert timeformat="%Y/%m/%d" mktime(_time) as Date

View solution in original post

somesoni2
Revered Legend

Try this one. decent performance.

index=yourindex| stats first(_time) as _time by date_mday | convert timeformat="%Y/%m/%d" mktime(_time) as Date

fredclown
Path Finder

Yeah, that is MUCH faster than my previous attempt. Thanks sir.

0 Karma

lukejadamec
Super Champion

You could create a summary index, and then back fill it with data in the background. It would take a while to backfill, but it does that in the background. Once it is done, it would be very fast to search, and re-search. Here is the link to the summary index page.

http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/Usesummaryindexing

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...