Splunk Search

eventcount - spanning over time

brdr
Contributor

I'm attempting to write a search using eventcount command. I want to graph the number of events in my index/sourcetype per day over a span of 1 week. Can I use the eventcount for this? I'm not having much luck.

| eventcount summarize=false index=myindex sourcetype=mysourcetype 
| timechart span=1d count
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The eventcount command just gives the count of events in the specified index, without any timestamp information. Since your search includes only the metadata fields (index/sourcetype), you can use tstats commands like this, much faster than regular search that you'd normally do to chart something like that.

| tstats count WHERE index=myindex sourcetype=mysourcetype by _time span=1d 

You might have to add | timechart span=1d sum(count) as count at the end if the chart doesn't look continuous.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The eventcount command just gives the count of events in the specified index, without any timestamp information. Since your search includes only the metadata fields (index/sourcetype), you can use tstats commands like this, much faster than regular search that you'd normally do to chart something like that.

| tstats count WHERE index=myindex sourcetype=mysourcetype by _time span=1d 

You might have to add | timechart span=1d sum(count) as count at the end if the chart doesn't look continuous.

brdr
Contributor

great. thank you.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...