Splunk Search

trend data from saved search

jmiddle1977
New Member

I have a saved search that looks at the previous 24 hours of data and pulls back a simple table with 4 values. Similar to below.

index=data profile_name="Workstations" | dedup src_ip | rangemap field=score Low=0-100,Medium=101-500,High=501-1000,Critical=1001-999999 | top limit=0 range

What i would like to do is to be able to see the trend of these values over time (3+ years) without having to query the 3 years worth of data.

My thought was to write the data to a lookup table each night with the date. Then, in a new search I could query that table to pull the trend over time. I'm having trouble finding a solution. if it matters, I do not have CLI access.

Thoughts? Thanks in advance

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What you want is a summary index. Run your daily saved search of the last 24 hours and save the 4 values to a summary index. Then you can search the SI for your trend. See http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Usesummaryindexing.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...