Splunk Search

How to create a table to show events for the past 7 days

aaroncherian
Path Finder

I am trying to create a table something like this that will fetch the data for all the events for the past 7 days. I want this to be ran any time and it would update the dates dynamically at the top. I want it to look something like this:

Host

Sourcetype

6/1

6/2

6/3

6/4

6/5

6/6

6/7

" "

" "

Count

Count

Count

Count

Count

Count

count

 

Here is my search so far:

index=" " | bucket span=1d _time | eval dayOfDate=strftime(_time,"%Y/%m/%d")  | stats count by host, sourcetype, dayOfDate | table host sourcetype dayOfDate count | rename count as "Number of events"

 

The dates show vertically and I wanted it to show up as column headers for the last 7 days that updates dynamically whenever I run this search.

Labels (5)
0 Karma
1 Solution

to4kawa
Ultra Champion

index=" " | bucket span=1d _time | eval dayOfDate=strftime(_time,"%Y/%m/%d") | stats count by host, sourcetype, dayOfDate | table host sourcetype dayOfDate count | eval hosts=host."::".sourcetype | xyseries hosts dayOfDate count

View solution in original post

to4kawa
Ultra Champion

index=" " | bucket span=1d _time | eval dayOfDate=strftime(_time,"%Y/%m/%d") | stats count by host, sourcetype, dayOfDate | table host sourcetype dayOfDate count | eval hosts=host."::".sourcetype | xyseries hosts dayOfDate count

aaroncherian
Path Finder

Thanks for that @to4kawa !! 

But is it possible to have two different columns for hosts and sourcetype instead of just them being combined into one column with a "::" in the middle? (Exact same format as my example output)

0 Karma

to4kawa
Ultra Champion

add
| rex field=hosts "(?<host>.*?)::(?<sourcetype>.*)"
| fields - hosts
| table host sourcetype *

aaroncherian
Path Finder

EDIT: Worked perfectly! Thanks @to4kawa !!!!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!