Splunk Search

Timechart question

bgill0123
Loves-to-Learn

I am currently running this search:

index=events host=hig1* or host=hig2* | timechart span-1d dc(host)

the search works and I get the results I need however is there a way to list out all hosts and still get the count?

thanks

Tags (1)
0 Karma

DalJeanis
Legend

1) OR should be capitalized. 2) span=1d

I don't see how it would work, visually, to show a count and also the names in a single viz panel. Seems like you might want a line chart or bar chart for the dc, and then have a different viz for the names. Like, for instance, build a popup using JS so that when you hover over a particular day, it gets the list of unique names for that day.

0 Karma

mayurr98
Super Champion

Try this

index=events host=hig1* OR host=hig2* | timechart span=1d dc(host) values(host)

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...