https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Timechart You'll want the useother and limit options for the timechart command. ... View more

hi @bgill0123 , The below query will give the total count of events per host every hour for the index. You can select any chart to see the pattern. | tstats count where index="indexname" by host, _time | timechart span=1h sum(count) as count by host   If this reply helps you, an upvote/like would be appreciated. ... View more

1) OR should be capitalized. 2) span=1d I don't see how it would work, visually, to show a count and also the names in a single viz panel. Seems like you might want a line chart or bar chart for the dc, and then have a different viz for the names. Like, for instance, build a popup using JS so that when you hover over a particular day, it gets the list of unique names for that day. ... View more

Not sure why you are comparing the results of those particular searches. Metadata is not always going to be consistently the same as the detailed event data on the actual index, so if you're using metadata for one side, you should use it for the other. You can also get that information in a single pass at the metadata, since you are not counting anything, just checking for the presence of records. All you need is the earliest and latest _time values in the 30 day window. I'm assuming you are looking for hosts that have not reported today. Here's how I'd do that. | metadata type=hosts | search host=abc1* or host=abc2* | eval host=upper(host) | stats max(lastTime) as lastTime, max(recentTime) as recentTime, min(firstTime) as firstTime by host | rename COMMENT as "now we have one record for each host, no matter what the hostname capitalization may have been" | rename COMMENT as "with the first and last event _times in that range, plus the _time of the most recent event" | rename COMMENT as "anything after midnight yesterday will be considered to be 'today' for comparison purposes" | rename COMMENT as "we will set one counter field for 'existed yesterday to 30 days ago' and one for 'existed today'" | rename COMMENT as "since each record is a different host at this point, summing up the values gets you the distinct count." | eval startofday=relative_time(now(),"-1d@d") | eval yesterday=case(firstTime<startofday,1) | eval today=case(lastTime>=startofday,1) | eval oldmissing=case(isnull(today),host) | eval newtoday=case(isnull(yesterday),host) | stats count as hostsTotal sum(yesterday) as hostsPrior sum(today) as hostsToday count(oldmissing) as hostsMissingCount values(oldmissing) as hostsMissingList count(newtoday) as hostsNewCount values(newtoday) as hostsNewList ... View more

@bgill0123, in order for the community to assist you, you will have to provide more details. These Users and their traffic that you intend to capture are within Splunk or your Custom Web Application that you are monitoring via Splunk? If this is Custom Web Application what kind of application/log is it that you are monitoring? Are you using existing App from Splunkbase like that for IIS or Tom Cat etc? Or is it your custom App built specifically for your Web application? Can you post some events from logs which you intend to use in order to identify users and their traffic? Please mock/anonymize any sensitive information that you have in the logs. Can you also give your current search along with dropdown code (mask/anonymize static user names)? ... View more