Splunk Search

How to create a more efficient sitimechart for distinct count?

pr0n
Explorer

When using index=blah | sitimechart dc(field1) by field2 It saves every single element for field1 concatenated into a new field called psrsvd_vm_field1. For me this makes for an insanely inefficient summary index with millions and millions of useless entries in the psrsvd_vm_field1 field. How can I streamline this so that it doesn't store all that information and have to sort through it every time I chart the summarized data.

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @pr0n,

If you're just looking to store the distinct count without the detailed multi-value, then all you have to do is save a timechart into a summary index using | collect instead of using sitimechart.

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @pr0n,

If you're just looking to store the distinct count without the detailed multi-value, then all you have to do is save a timechart into a summary index using | collect instead of using sitimechart.

Cheers,
David

0 Karma

pr0n
Explorer

How do I timechart the summary? My understanding is I need sitimechart to prepare data for proper timechart once it's summarized.

0 Karma

DavidHourani
Super Champion

Well it depends on what you're trying to achieve, because if you need to be able to run a dc over any time span then you will need that inefficient mv field. But if you're only interested in keeping a specific time interval in your summary then going for the results of a timechart would do the trick for you.
It'll only save _time and dc value instead of saving _time, dcand all values.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...