Graph of rolling totals

[andrewbeak]

Hi,

I want to create a graph that shows calculated values by time.

Each value must be calculated as the number of unique users visiting the site for the three months prior to that date.

In order to try and limit the amount of work required I want to only show one value per week.

So the value for 1 May 2018 must be the number of unique users from 1 Feb to 1 May 2018. The value for 14 May must be the number of users from 14 Feb to 14 May.

I'm pretty sure that I need to use "eval", but I'm struggling to work out how to "eval the distinct count of user.id for three months from the current row _time"

Any ideas how to accomplish this?

[niketn]

@andrewbeak do you want to create a chart from a table drilldown? What do you mean by for three months from the current row _time?

Also do you want previous three months or one month as per you sample data?

Earliest Time in the Time Picker will -1mon@d or -3mon@d based on last month or last 3 months as needed.

For creating weekly stats you can refer to one of my previous answers and adjust as per your needs: https://answers.splunk.com/answers/637244/time-range-to-display-count-of-weekly.html

[knielsen]

I understood it like he wants to have a weekly rolling dc(user.id) over the last 3 months, so the time ranges always overlap. And if that's the case, I'd really go with a summary index, having a weekly search over the last 3 months. Easy to use, and depending on the amount of data a hell of lot faster to display in the end, when you just pull the precalculated results for each week.

[andrewbeak]

Thanks, that is what I am trying to do. I hadn't considered a summary index but that's a really good idea and I'll try to include that.