Splunk Search

How to use timechart command for the below query

divyathota
New Member

This is the query i m using:
query1:

sourcetype=tanium earliest=-24h query="User-Sessions-and-Boot-Time-Details-from-Windows" OR query="User-current-session-details-&-Last-Boot-Time---Mac-OSX-to-Splunk" Uptime="1 days" OR Uptime="Less than 1 day" NOT Last_Logged_In_User="*adm"| table Computer_Name Last_Logged_In_User OS_Boot_Time Last_Reboot| eval LastReboot = coalesce(OS_Boot_Time, Last_Reboot)| dedup LastReboot,Last_Logged_In_User| stats count by Computer_Name,Last_Logged_In_User | where count>2

i need a trend analysis for this query for last 30 days.

I also did this:
query2:

sourcetype=tanium query="User-Sessions-and-Boot-Time-Details-from-Windows" OR query="User-current-session-details-&-Last-Boot-Time---Mac-OSX-to-Splunk" NOT Last_Logged_In_User="*adm" | eval LastReboot = coalesce(OS_Boot_Time, Last_Reboot)| dedup LastReboot,Last_Logged_In_User| timechart span=1d count |eval day = strftime(_time,"%d %b %y , %a") |chart sum(count) by day

But, this gives me the entire number of events.
Can anyone help me how to add required condition from query1 to query2

0 Karma

woodcock
Esteemed Legend

Like this?

index=YouShouldAlwaysSpecifyIndexValues AND ((sourcetype=tanium AND query="User-Sessions-and-Boot-Time-Details-from-Windows") OR (query="User-current-session-details-&-Last-Boot-Time---Mac-OSX-to-Splunk" AND NOT Last_Logged_In_User="*adm"))
| eval LastReboot = coalesce(OS_Boot_Time, Last_Reboot) 
| dedup LastReboot,Last_Logged_In_User 
| bin _time span=1d 
| eventstats count BY Computer_Name,Last_Logged_In_User _time 
| where count>2 
| timechart span=1d count 
| eval day = strftime(_time,"%d %b %y , %a") 
| chart sum(count) by day

NOTE: I may not have done the parentheses correctly but you should NEVER EVER mix AND and OR without parentheses!

0 Karma

niketn
Legend

@divyathota, is the following what you are looking for?

sourcetype=tanium earliest=-24h query="User-Sessions-and-Boot-Time-Details-from-Windows" OR query="User-current-session-details-&-Last-Boot-Time---Mac-OSX-to-Splunk" Uptime="1 days" OR Uptime="Less than 1 day" Last_Logged_In_User!="*adm"
| eval LastReboot = coalesce(OS_Boot_Time, Last_Reboot) 
| dedup LastReboot,Last_Logged_In_User
| bin _time span=1d
| stats count by _time, Last_Logged_In_User, Computer_Name
| search count>2
| timechart sum(count) as Total
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

skalliger
Motivator

If you want a trendline, you might want to use trendline instead of chart. This one does what you want. Look at the examples in the docs.
Also, you might want to use Last_Logged_In_User!="*adm" instead of NOT Last_Logged_In_User="*adm" if you're always expecting a user in your events.

Edit: In your first query, that table command is kind of useless. You can remove it If you're after speeding up the query, replace it with fields and put only the needed events in.

Skalli

0 Karma
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...