Splunk Search

how to plot count of distinct value over time?

davidoh0905
Engager

earliest=-6month sourcetype="mysource" | timechart span=1week count by product_name

I was running this in order to see the trend over time. The intention was to see the whole count summation of 1 week over 6 month span. but I am not sure whether this query is showing summation of counts of entire week or just showing single day's count separate by 1week time span.

Please let me know if this is counting the 7 days worth of count or just showing count of one day calculated every 7 days.

Thank you!

0 Karma
1 Solution

sundareshr
Legend

Your search will show 7 day totals, However, these are not distinct counts. This counts EVERY event index in that sourcetype by product_name in the past 7 days for 6 months.

View solution in original post

somesoni2
Revered Legend

If your requirement is to get number of events for each product per week, including all 7 days of the week, you already have the query. It's not distinct count of the product.

0 Karma

sundareshr
Legend

Your search will show 7 day totals, However, these are not distinct counts. This counts EVERY event index in that sourcetype by product_name in the past 7 days for 6 months.

davidoh0905
Engager

thank you! could you teach me how to use distinct count??

0 Karma

sundareshr
Legend

What is it that you want the distinct count of? The below will give your distinct_count of product_name. In other words, it will tell you how many distinct products were in each week for past 6 months.

earliest=-6month sourcetype="mysource" | timechart span=1week dc(product_name) 
0 Karma

davidoh0905
Engager

Thank you! @sundareshir

0 Karma

sundareshr
Legend

Please mark the question as answered to close it out.

0 Karma

kunalmao
Communicator

It is showing you the summation of 7 days starting your period of 6 months. The query is serving you the purpose, additionally if you are interested in getting no repeated values you can pipe a dedup before timechart.

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...