How to write a conditional timechart search that will not count more than 1 event per day?

[splunkrsherman]

I'd like an efficient search that will return either "Yes" or "No" for a timechart per day. I would imagine a limiting function and some evaluation may be necessary. I'm trying to avoid having splunk chew through counting more than 1 log record per day to simply confirm logs were simply present for that condition in the day.

I would imagine the search would like:

base search | timechart span=1d limit 1 as count | eval if(count > 0), "Yes", "No"

[woodcock · Accepted solution]

Like this:

Index=* | dedup date_month date_mday host sourcetype | timechart span=1d | where count=0

This will show you sources of data that have not reported events in any full day, the most efficient way.

[splunkrsherman]

Thanks woodcock, this is useful and where a report is empty it indicates there were no days with 0 logs. Is there a way to inversely have a record for each day at least 1 log was present? For instance, a "Yes" for each day during the time period at least 1 log event matches the search string.

[woodcock]

Try this:

index=* | dedup date_month date_mday host sourcetype | timechart span=1d | eval OK=if(count=0,"NO","YES")

Don't forget to "Accept" the answer.

[splunkrsherman]

woodcock, thanks for your continued response.

Seems like the right track, but timechart will not work for me without supplying a field to chart by, I'm guessing I should use count. When I do that it dedups and rolls all into the most recent date/time with a count of days (7 for a week).