I'd like an efficient search that will return either "Yes" or "No" for a timechart per day. I would imagine a limiting function and some evaluation may be necessary. I'm trying to avoid having splunk chew through counting more than 1 log record per day to simply confirm logs were simply present for that condition in the day.
I would imagine the search would like:
base search | timechart span=1d limit 1 as count | eval if(count > 0), "Yes", "No"
Like this:
Index=* | dedup date_month date_mday host sourcetype | timechart span=1d | where count=0
This will show you sources of data that have not reported events in any full day, the most efficient way.
Like this:
Index=* | dedup date_month date_mday host sourcetype | timechart span=1d | where count=0
This will show you sources of data that have not reported events in any full day, the most efficient way.
Thanks woodcock, this is useful and where a report is empty it indicates there were no days with 0 logs. Is there a way to inversely have a record for each day at least 1 log was present? For instance, a "Yes" for each day during the time period at least 1 log event matches the search string.
Try this:
index=* | dedup date_month date_mday host sourcetype | timechart span=1d | eval OK=if(count=0,"NO","YES")
Don't forget to "Accept" the answer.
woodcock, thanks for your continued response.
Seems like the right track, but timechart will not work for me without supplying a field to chart by, I'm guessing I should use count. When I do that it dedups and rolls all into the most recent date/time with a count of days (7 for a week).