Splunk Search

How to write a conditional timechart search that will not count more than 1 event per day?

splunkrsherman
New Member

I'd like an efficient search that will return either "Yes" or "No" for a timechart per day. I would imagine a limiting function and some evaluation may be necessary. I'm trying to avoid having splunk chew through counting more than 1 log record per day to simply confirm logs were simply present for that condition in the day.

I would imagine the search would like:

base search | timechart span=1d limit 1 as count | eval if(count > 0), "Yes", "No"
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Index=* | dedup date_month date_mday host sourcetype | timechart span=1d | where count=0

This will show you sources of data that have not reported events in any full day, the most efficient way.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Index=* | dedup date_month date_mday host sourcetype | timechart span=1d | where count=0

This will show you sources of data that have not reported events in any full day, the most efficient way.

0 Karma

splunkrsherman
New Member

Thanks woodcock, this is useful and where a report is empty it indicates there were no days with 0 logs. Is there a way to inversely have a record for each day at least 1 log was present? For instance, a "Yes" for each day during the time period at least 1 log event matches the search string.

0 Karma

woodcock
Esteemed Legend

Try this:

index=* | dedup date_month date_mday host sourcetype | timechart span=1d | eval OK=if(count=0,"NO","YES")

Don't forget to "Accept" the answer.

0 Karma

splunkrsherman
New Member

woodcock, thanks for your continued response.

Seems like the right track, but timechart will not work for me without supplying a field to chart by, I'm guessing I should use count. When I do that it dedups and rolls all into the most recent date/time with a count of days (7 for a week).

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...