Splunk Search

Save results to avoid recalculation for new users per day or total number of distinct users

tmtcollins
Explorer

I am pretty new to Splunk and this is my first posted question so here goes...

I have an application and I need to identify:

  1. Total distinct users (all time)
  2. Total distinct users (Week to date)

My query for total distinct users is basic - ns=monocle Action=Search|stats distinct_count(Email)

The problem is that this query takes ages to run as it has to calculate the total every time it is run.

Is there a more efficient way of doing this? For example, a way of saving the previous results to make the next calculation simpler?

Many thanks,

Tim

Tags (1)
0 Karma

somesoni2
Revered Legend

How many distinct users could be there? I believe you can utilize Splunk's summary index feature here to achieve efficiency in your reports (your need to run reports on larger period, ans need rolling report as well). See this for more information: https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/Usesummaryindexing

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...