Splunk Search

search adding instead of representing a trend

Esky73
Builder

I'm trying to rectify a search where the chart should represent a Trend but is actually just adding the last active user and the current active user and showing it in the Trend Column :
eg :
2016-08-10 11:10:00 17 17
2016-08-10 11:15:00 20 37
2016-08-10 11:20:00 0 37

search :

index="X" sourcetype="Y" DOMAIN="ACTIVE_USER" | lookup host_lookup HOSTNAME OUTPUT SYSTEM | dedup HOSTNAME,ACTIVE_USER | where ACTIVE_USER!="NO_USER" | timechart span=5m dc(ACTIVE_USER) as "Active User Count" | addtotals | streamstats sum(Total) as "Trend" | fields - Total

Tags (1)
0 Karma

Jeremiah
Motivator

Try using trendline:

index="X" sourcetype="Y" DOMAIN="ACTIVE_USER" | lookup host_lookup HOSTNAME OUTPUT SYSTEM | dedup HOSTNAME,ACTIVE_USER | where ACTIVE_USER!="NO_USER" | timechart span=5m dc(ACTIVE_USER) as "active_users" | trendline sma5(active_users)

https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Trendline

Also two comments on your search, first, you don't seem to be using the value from the lookup (SYSTEM). And second, it doesn't seem necessary to dedup by hostname,active_user when you are using dc (which give you a distinct count of active users).

Esky73
Builder

Thanks for your help

The lookup file OUTPUT isn't a field in the csv (HOSTNAME and SERVER exist) but as we aren't using those values not sure why we are using it ?

If dc(ACTIVE_USER) is used then no need to dedup right ? so i will remove that.

So my search looks like so ..

index="X" sourcetype="Y" DOMAIN=ACTIVE_USER | lookup host_lookup HOSTNAME OUTPUT SYSTEM | where ACTIVE_USER!="NO_USER" | timechart span=5m dc(ACTIVE_USER) as "Active User Count" | trendline sma5("Active User Count") AS Trend

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...