dc rolling over time

[vbumgarn]

Looking at the results from a popular web analytic site, their definition of "current visitors" seems to be "distinct count over rolling five minutes". I'd like to replicate that in Splunk, but I couldn't find an elegant way to keep a rolling dc for five minute blocks without starting over. You could simply say timechart span=5m dc(clientip) but that's not quite the same thing, as I would like a bar per minute that represents the previous 5 minutes.

I've come up with a query that works, but I'm hoping someone more clever than I can shorten this query a bit. Maybe there's a timechart function I'm missing, or a range function of some sort that would shorten the eval, or a weird use of streamstats:

1. index=httpd sourcetype=httpd-access
2. | bucket span=1m _time
3. | eval t=split( _time + "," + tostring(_time+60) + "," + tostring(_time+120) + "," + tostring(_time+180) + "," + tostring(_time+240) , "," )
4. | stats dc(clientip) as dc by t
5. | where t<now()
6. | eval _time=t
7. | timechart span=1m max(dc) as dc

Just to step through what it does...

1. Find the events.
2. Floor _time of each event to the minute.
3. Make a multivalued field t with _time and the next four minutes.
4. Calculate the dc per minute. Since t is multivalued, each event will count towards its minute and the four minutes after it.
5. Throw away the future minutes created on events in the last minute.
6. Reset _time to t for the timechart.
7. Chart it.

[sideview]

I think you'll be much happier using streamstats with it's window argument.

index=httpd sourcetype=httpd-access | timechart dc(clientip) as dc span=1m | streamstats avg(dc) as rollingAvg window=5

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/streamstats

[vbumgarn]

I don't think that will give the same answer. After the timechart, you have a dc per minute, but you've lost what the dc for groupings of five minutes would have been.

I wonder if this would be more efficient...

index=httpd sourcetype=httpd-access
| timechart span=1m values(clientip) as ips 
| streamstats dc(ips) as dc window=5
| fields - ips