Splunk Search

How to create a more efficient sitimechart for distinct count?

pr0n
Explorer

When using index=blah | sitimechart dc(field1) by field2 It saves every single element for field1 concatenated into a new field called psrsvd_vm_field1. For me this makes for an insanely inefficient summary index with millions and millions of useless entries in the psrsvd_vm_field1 field. How can I streamline this so that it doesn't store all that information and have to sort through it every time I chart the summarized data.

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @pr0n,

If you're just looking to store the distinct count without the detailed multi-value, then all you have to do is save a timechart into a summary index using | collect instead of using sitimechart.

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @pr0n,

If you're just looking to store the distinct count without the detailed multi-value, then all you have to do is save a timechart into a summary index using | collect instead of using sitimechart.

Cheers,
David

0 Karma

pr0n
Explorer

How do I timechart the summary? My understanding is I need sitimechart to prepare data for proper timechart once it's summarized.

0 Karma

DavidHourani
Super Champion

Well it depends on what you're trying to achieve, because if you need to be able to run a dc over any time span then you will need that inefficient mv field. But if you're only interested in keeping a specific time interval in your summary then going for the results of a timechart would do the trick for you.
It'll only save _time and dc value instead of saving _time, dcand all values.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...