Splunk Search

How to write a conditional timechart search that will not count more than 1 event per day?

splunkrsherman
New Member

I'd like an efficient search that will return either "Yes" or "No" for a timechart per day. I would imagine a limiting function and some evaluation may be necessary. I'm trying to avoid having splunk chew through counting more than 1 log record per day to simply confirm logs were simply present for that condition in the day.

I would imagine the search would like:

base search | timechart span=1d limit 1 as count | eval if(count > 0), "Yes", "No"
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Index=* | dedup date_month date_mday host sourcetype | timechart span=1d | where count=0

This will show you sources of data that have not reported events in any full day, the most efficient way.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Index=* | dedup date_month date_mday host sourcetype | timechart span=1d | where count=0

This will show you sources of data that have not reported events in any full day, the most efficient way.

0 Karma

splunkrsherman
New Member

Thanks woodcock, this is useful and where a report is empty it indicates there were no days with 0 logs. Is there a way to inversely have a record for each day at least 1 log was present? For instance, a "Yes" for each day during the time period at least 1 log event matches the search string.

0 Karma

woodcock
Esteemed Legend

Try this:

index=* | dedup date_month date_mday host sourcetype | timechart span=1d | eval OK=if(count=0,"NO","YES")

Don't forget to "Accept" the answer.

0 Karma

splunkrsherman
New Member

woodcock, thanks for your continued response.

Seems like the right track, but timechart will not work for me without supplying a field to chart by, I'm guessing I should use count. When I do that it dedups and rolls all into the most recent date/time with a count of days (7 for a week).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...