Splunk Search

Linechart with clustered data

paxo
Loves-to-Learn Lots

Hi all, I need to show the number of concurrent logged users within the last 30 days. What I would like to have is a linechart showing for each day an overview with the most important spikes happened. So far I have implemented this query which works as expected but takes more than a minute to load entirely since it shows all the concurrent users for each minute of the day, for each day of the month. I don't need to see the status for each minute of the day, that's why I'm thinking about grouping data per day.

sourcetype=my_log source=/var/log/mylog.log | bucket _time span=1m | stats dc(cID) by _time | rename dc(cID) as concurrent_users

cID is the unique identifier string per user

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
I agree that minute granularity is too fine for a 30-day window. Change "span=1m" to "span=1d" to get days. Consider "span=8h" if you want to see spikes during a day.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...