Fastest way to count records per day

[JensT]

Hello,

hopefully this has not been asked 1000 times.

I'd like to count the number of records per day per hour over a month. We have ~ 100.000.000 - 150.000.000 records per day. So a simple "* | timechart span=1h count" takes veeery long.

Was the fastest way to do this?

Regards,

Jens

[the_wolverine]

| tstats count where index=* groupby index,_time span=1d

[jmeyers_splunk]

I know this is an old post, but in this case I would look at either: metadata(http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/metadata) or tstats (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats)

[MuS]

+1 for tstats which will be faster then metadata

[jrodman]

Using the advanced charting view may speed it up a bit.

Just getting that many buckets (timeslots) may end up being problematic.

If you want to solve this problem for the future, summary indexing might be the right approach.

If you want a very very rough idea, you could use the commands which probe index state such as are used to back the searches for the indexing dashboard. These tell you things about where your buckets exist in time, and then some fancy calculations could give you an upper bound on the number of events over that month.

If you want just a total, you could try date_month=1 date_year=2011 | stats count by date_day