Splunk Search

How to best track the frequency of repeating events

Splunk Employee
Splunk Employee


I'm after suggestions on how to best approach this problem.

I want to track over time how often I am seeing a mac address (src_mac) as categorised as:

first time: never seen before

daily: seen once per day for last 14 days

weekly: seen at least once per week for last 8 weeks

occasionally: seen before but not categorised as the above.

I then want to timechart this on a day-by-day basis.

Labels (2)
0 Karma


Hi @pwild_splunk,

this is an heavy and long search, so you can have two approaches:

  • if you need a static server, you can schedule a report every night and access the results in the following 24 hours until the next execution;
  • if instead you want a dynamic report, you could schedule a search and store reults in a summary index, then use it to compare the results of the last day with the results of previous days from the summary index.

the first is easier (only one search) but static, the second has two parts (scheduled search and runtime search) but it's dynamic.



0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...