Splunk Search

how to plot count of distinct value over time?

davidoh0905
Engager

earliest=-6month sourcetype="mysource" | timechart span=1week count by product_name

I was running this in order to see the trend over time. The intention was to see the whole count summation of 1 week over 6 month span. but I am not sure whether this query is showing summation of counts of entire week or just showing single day's count separate by 1week time span.

Please let me know if this is counting the 7 days worth of count or just showing count of one day calculated every 7 days.

Thank you!

0 Karma
1 Solution

sundareshr
Legend

Your search will show 7 day totals, However, these are not distinct counts. This counts EVERY event index in that sourcetype by product_name in the past 7 days for 6 months.

View solution in original post

somesoni2
Revered Legend

If your requirement is to get number of events for each product per week, including all 7 days of the week, you already have the query. It's not distinct count of the product.

0 Karma

sundareshr
Legend

Your search will show 7 day totals, However, these are not distinct counts. This counts EVERY event index in that sourcetype by product_name in the past 7 days for 6 months.

davidoh0905
Engager

thank you! could you teach me how to use distinct count??

0 Karma

sundareshr
Legend

What is it that you want the distinct count of? The below will give your distinct_count of product_name. In other words, it will tell you how many distinct products were in each week for past 6 months.

earliest=-6month sourcetype="mysource" | timechart span=1week dc(product_name) 
0 Karma

davidoh0905
Engager

Thank you! @sundareshir

0 Karma

sundareshr
Legend

Please mark the question as answered to close it out.

0 Karma

kunalmao
Communicator

It is showing you the summation of 7 days starting your period of 6 months. The query is serving you the purpose, additionally if you are interested in getting no repeated values you can pipe a dedup before timechart.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...