Splunk Search

How to create a more efficient sitimechart for distinct count?

pr0n
Explorer

When using index=blah | sitimechart dc(field1) by field2 It saves every single element for field1 concatenated into a new field called psrsvd_vm_field1. For me this makes for an insanely inefficient summary index with millions and millions of useless entries in the psrsvd_vm_field1 field. How can I streamline this so that it doesn't store all that information and have to sort through it every time I chart the summarized data.

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @pr0n,

If you're just looking to store the distinct count without the detailed multi-value, then all you have to do is save a timechart into a summary index using | collect instead of using sitimechart.

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @pr0n,

If you're just looking to store the distinct count without the detailed multi-value, then all you have to do is save a timechart into a summary index using | collect instead of using sitimechart.

Cheers,
David

0 Karma

pr0n
Explorer

How do I timechart the summary? My understanding is I need sitimechart to prepare data for proper timechart once it's summarized.

0 Karma

DavidHourani
Super Champion

Well it depends on what you're trying to achieve, because if you need to be able to run a dc over any time span then you will need that inefficient mv field. But if you're only interested in keeping a specific time interval in your summary then going for the results of a timechart would do the trick for you.
It'll only save _time and dc value instead of saving _time, dcand all values.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...