Splunk Search

How to dedup search to limit to 1 event per host per day

DamageSplunk
Explorer

I'm using the winhostmon collection and I want to chart disk space usage over time. I have the collection set up to run once a day. The issue is that if splunk is restarted at any time, the collection runs again, producing more than one event per day and that skews the total per day. I've tried to limit the maxevents=1, but that doesn't seem to fix the problem and I'd prefer not to dedup based on host+Name+date. Is there a better way?

index=machine host=*hostfilter* sourcetype=winhostmon source=disk DriveType=fixed NOT Name="C:"
 | transaction host, TotalSpaceKB, FreeSpaceKB maxevents=1 maxspan=1d
 | eval gbtotal=(TotalSpaceKB/1024/1024/1024)
 | eval gbfree=(FreeSpaceKB/1024/1024/1024)
 | eval gbused=((TotalSpaceKB-FreeSpaceKB)/1024/1024/1024) 
 | timechart span=1d sum(gbtotal) as TotalSpaceTB, sum(gbfree) as TotalFreeTB
Tags (3)
0 Karma

yannK
Splunk Employee
Splunk Employee

The dedup on host / date works.
another method is to get rid of the transaction and use a less costly stats with the function first() (firs is counter intuitive, means the last value of the period, as splunk search backward in time)

<mysearch> 
| bucket _time span=1d 
| stats first(TotalSpaceKB) AS TotalSpaceKB 
            first(FreeSpaceKB) AS FreeSpaceKB 
            by host  _time
| eval gbtotal=(TotalSpaceKB/1024/1024/1024)
| eval gbfree=(FreeSpaceKB/1024/1024/1024)
| eval gbused=((TotalSpaceKB-FreeSpaceKB)/1024/1024/1024) 
| timechart span=1d sum(gbtotal) as TotalSpaceTB, sum(gbfree) as TotalFreeTB
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...