Splunk Search

timechart vs. streamstats

mctester
Communicator

If I do this:

index="foo" sourcetype="bar" | sort _time | streamstats dc(userid) as dcusers | delta dcusers as deltadcusers

This gives me a 0 on the event if the user has been seen before, or 1 if the user is a new user.

But then if I:

| timechart sum(deltadcusers)

It starts out looking right, then progressively collects backwards until there is only one data point at the start containing the same value as stats dc(userid) for the whole time window.

If I leave out the sort _time, then the streamstats command gives values backwards from what I want - it streams backwards in time, I want it streamed forwards from the start of the day.

This doesn't seem right at all, how do I/can I get streamstats and timechart to interact in a sane way in this sort of scenario?

Tags (2)

blilburne
Explorer

Yes, I want to see how many "not seen before on this day" user IDs are coming online on an hourly basis through the day.

Without the sort, it appears to work correctly but the graph is backwards - i.e, the highest count for streamstats is at the start, which means all the deltas/dc values are backwards.

If I sort it, it appears to truncate the results - i.e, I will only see values for a fraction of the time span, and this does not make sense as there are events across the whole timespan, all have userids.

Basically I want streamstats to run forward in time the same way it does for an rtsearch.

blilburne
Explorer

This appears to do what I want:

... | dedup userid sortby +_time | timechart count

This does not:

... | sort +_time | dedup userid | timechart count

Streamstats doesn't have a sortby so it appears not to be possible to do the same with streamstats (change the direction in which they are streamed).

0 Karma

steveyz
Splunk Employee
Splunk Employee

so what does the output of

index="foo" sourcetype="bar" | sort _time | streamstats dc(userid) as dcusers | delta dcusers as deltadcusers | timechart sum(deltadcusers)

look like?

Seems like you want to get a chart of how many new users you are getting for each time span?

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...