plotting unique values using timecharts

[chan2]

Hi,

I'd like to draw a quick chart of unique instances of a given field over time. Specifically, I'd like a chart with:
x-axis: time in increments of days or hours
y-axis: number of unique users as defined by the field 'userid'
So regardless of how many userids appear on a given day, the chart would only display a single line with the number of unique userids.

I tried the following query, but it does not provide the above:
* | timechart count by unique(userid)

A sample log event would be:
event userid=X

[jonuwz · Accepted solution]

You need

... | timechart span=1d dc(userid)

Where dc = distinct count.

[yoho]

Don't know enough about Splunk to tell you exactly what to do, but I would use summary indexes. You need in a field the value you're trying to plot and if I understand well, you don't have this value anywhere in your log files. So you should run a summary search every day or every hour which is counting the number of unique user ids since the previous time the summary search was run. Once you get this result, it will be easy to plot what you need.

To get your summary index, you will have to extract your "userid" field (with multikv ?) and then pipe this through the "uniq" command and count the results.

Hope that helps.