Splunk Search

How to search in real time and append those values in dashboard?

badrinath
Path Finder

Hi all, 

whenever I get a new log I wanted to count of the number of logs for the last 5 min and then append it to a graph. but I should be able to see graph of 1whole day

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this?

| timechart span=5m distinct_count(source)

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

badrinath
Path Finder

actually I need to do a real time search and append the results to a graph continuously.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's what should happen using the above.

---
If this reply helps you, Karma would be appreciated.
0 Karma

badrinath
Path Finder

that's correct  but its creating something like buckets of 10min each like 2:00 to 2:10 and then counting in that time range.

but what I need is as soon as I get data lets say at 2:14 it should count the data from 2:04 to 2:14 and then append the count to graph.

when I get new data at 2:16 again it should count from 2:06 to 2:16 and append the count to graph again.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...