Splunk Search

Distinct Events Days in Index

fredclown
Contributor

I'm trying to write an efficient search to find out the distinct days of events that I have in an index. Basically, I want to be able to see if I am missing data for any days. I could pipe the date in mm/dd/yyyy format to a table and then use dedup, but that is SLOW and my hunch is there is a better and faster way to do it.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this one. decent performance.

index=yourindex| stats first(_time) as _time by date_mday | convert timeformat="%Y/%m/%d" mktime(_time) as Date

View solution in original post

somesoni2
Revered Legend

Try this one. decent performance.

index=yourindex| stats first(_time) as _time by date_mday | convert timeformat="%Y/%m/%d" mktime(_time) as Date

fredclown
Contributor

Yeah, that is MUCH faster than my previous attempt. Thanks sir.

0 Karma

lukejadamec
Super Champion

You could create a summary index, and then back fill it with data in the background. It would take a while to backfill, but it does that in the background. Once it is done, it would be very fast to search, and re-search. Here is the link to the summary index page.

http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/Usesummaryindexing

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...