Splunk Search

How to create a report to count events per day over a 6 month time span?

prurek
New Member

I am looking to set up a report counting daily occurrences over a period of 6 months, I want to be able to run this report on request. I've been looking around for a search to get this, but have run into a wall. Any help would be appreciated.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Does the event that you're counting has retention period or more than 6 months? If yes, then you can run simple search like base search | timechart span=1d count on 6 month time range to get your report. If the retention period is less than 6 months than, you can get that report, at least not right away and directly. You would've to setup summary indexing , where you'll run a search daily to get count of events for yesterday and store it in a summary index with retention period of 6month or more. After a while this summary index will have data for your report.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Does the event that you're counting has retention period or more than 6 months? If yes, then you can run simple search like base search | timechart span=1d count on 6 month time range to get your report. If the retention period is less than 6 months than, you can get that report, at least not right away and directly. You would've to setup summary indexing , where you'll run a search daily to get count of events for yesterday and store it in a summary index with retention period of 6month or more. After a while this summary index will have data for your report.

0 Karma

prurek
New Member

Thank you, that works perfectly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...