Hi everyone,
Would appreciate your input on a challenge. For our leadership's dashboard we've been asked to include a timechart of total servers (Windows and NIX).
My current search is just taking too long (7 hours). I can cron it for 5:30am and populate the dashboard. They don't need to the minute data, but data would be nice period.
"(index=unix OR index=windows) (sourcetype=WinEventLog* OR source=/var/log/*) (host!=*.ga.com) earliest=-5w@w latest=now
| eval host=upper(host)
| timechart dc(host) AS "Total Servers" span=1Mon
| delta "Total Servers" "
I would use tstats command here since your base search uses only the metadata fields (host/source/sourcetype/index-time created fields).
| tstats count WHERE (index=unix OR index=windows) (sourcetype="WinEventLog*" OR source="/var/log/*") (host!="*.ga.com") earliest=-5w@w latest=now by _time host span=1mon
| eval host=upper(host)
| timechart dc(host) AS "Total Servers" span=1mon
| delta "Total Servers"
I would use tstats command here since your base search uses only the metadata fields (host/source/sourcetype/index-time created fields).
| tstats count WHERE (index=unix OR index=windows) (sourcetype="WinEventLog*" OR source="/var/log/*") (host!="*.ga.com") earliest=-5w@w latest=now by _time host span=1mon
| eval host=upper(host)
| timechart dc(host) AS "Total Servers" span=1mon
| delta "Total Servers"
Somesoni2 Rocks!! (as usual).
The tstats finished in 16.6 minutes (from 7 hours). This was across 84 Billion events!!