Splunk Search

How to create a single value timechart after stats?

alc2019
New Member

Hi,

I'm doing a device count based on device latest time event registration. I'm getting the correct device registration count here on a single value (ex. 1000 count) filed but with no trending:

index.... ... earliest=-1mon
| stats count latest(_time) as last_update by device_name EventType
| search EventType="Registered"
| stats count(device_name) as Device_Count by last_update

I would like create a single value visualization to show trend of device registration compared to 2 weeks ago count. I tried the following but I'm not getting the same count as my device registration.

index.... ... earliest=-1mon
| stats count latest(_time) as last_update by device_name EventType _time
| search EventType="Registered"
| stats count(device_name) as Device_Count by last_update
| timechart span=2w count(Device_Count)

How can I fix this to show trend of the correct count of registered devices compared to 2-weeks ago?

0 Karma
1 Solution

renjith_nair
Legend

@alc2019,

Try

 index.... ... earliest=-1mon EventType="Registered"
 | timechart span=2w count(device_name) as device_count
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@alc2019,

Try

 index.... ... earliest=-1mon EventType="Registered"
 | timechart span=2w count(device_name) as device_count
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

alc2019
New Member

Hi Renjith,

Thanks for the help but it will not work on my case as those devices register multiple times in a day and I have to count the registration based on their latest registration time.

Thanks

0 Karma

renjith_nair
Legend

@alc2019,
What about

      index.... ... earliest=-1mon EventType="Registered"
     |stats latest(_time) as _time by device_name
      | timechart span=2w count(device_name) as device_count
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

alc2019
New Member

Perfect - works!

Thank you

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...