Splunk Search

plotting unique values using timecharts

Engager

Hi,

I'd like to draw a quick chart of unique instances of a given field over time. Specifically, I'd like a chart with:
x-axis: time in increments of days or hours
y-axis: number of unique users as defined by the field 'userid'
So regardless of how many userids appear on a given day, the chart would only display a single line with the number of unique userids.

I tried the following query, but it does not provide the above:
* | timechart count by unique(userid)

A sample log event would be:
event userid=X

Tags (2)
1 Solution

Influencer

You need

... | timechart span=1d dc(userid)

Where dc = distinct count.

View solution in original post

Influencer

You need

... | timechart span=1d dc(userid)

Where dc = distinct count.

View solution in original post

Contributor

Don't know enough about Splunk to tell you exactly what to do, but I would use summary indexes. You need in a field the value you're trying to plot and if I understand well, you don't have this value anywhere in your log files. So you should run a summary search every day or every hour which is counting the number of unique user ids since the previous time the summary search was run. Once you get this result, it will be easy to plot what you need.

To get your summary index, you will have to extract your "userid" field (with multikv ?) and then pipe this through the "uniq" command and count the results.

Hope that helps.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!