Splunk Search

Gathering Six Months of Trend Data

giventofly08
Explorer

I'm still relatively new to Splunk and am having trouble understanding Timechart and the proper syntax for it. I'm looking to gather 6 months worth of Trend data for compliance purposes. Currently, I've got the following in order to get the initial (monthly) data point so that each month it updates to the new 6 month window:

search query | dedup 2 items | stats count(eval(state="passed")) AS Passed, count(eval(state="failed")) AS Failed | eval Percent_Compliance=(100-((Failed/Passed)*100))

I assume that I want to set the search range as 6 months instead of 1 month, but outside of that I don't really understand how to implement timechart or if there is a better solution. Thank you in advance.

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@giventofly08 ,

If you want to see a trend of last 6 months over 1 month span,

try

search query earliest=-6m@m| dedup 2 items | timechart span=1mon count(eval(state="passed")) AS Passed, count(eval(state="failed")) AS Failed | eval Percent_Compliance=(100-((Failed/Passed)*100))
Happy Splunking!
0 Karma

giventofly08
Explorer

It's returning 0 results at this moment. Perhaps I missed something? For simplicity sake here's the whole thing:

index=bigfix sourcetype="bigfix:compliance" source_severity="high" state="passed" OR state="failed" earliest=-6m@m | dedup comp_id check_id | timechart span=1mon count(eval(state="passed")) AS Passed, count(eval(state="failed")) AS Failed | eval Percent_Compliance=(100-((Failed/Passed)*100))

That's generating 0 results, where as before the timechart addition it would show the checks that passed, failed, and the percentage of it.

Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...