Splunk Search

How to create a single value timechart after stats?

alc2019
New Member

Hi,

I'm doing a device count based on device latest time event registration. I'm getting the correct device registration count here on a single value (ex. 1000 count) filed but with no trending:

index.... ... earliest=-1mon
| stats count latest(_time) as last_update by device_name EventType
| search EventType="Registered"
| stats count(device_name) as Device_Count by last_update

I would like create a single value visualization to show trend of device registration compared to 2 weeks ago count. I tried the following but I'm not getting the same count as my device registration.

index.... ... earliest=-1mon
| stats count latest(_time) as last_update by device_name EventType _time
| search EventType="Registered"
| stats count(device_name) as Device_Count by last_update
| timechart span=2w count(Device_Count)

How can I fix this to show trend of the correct count of registered devices compared to 2-weeks ago?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@alc2019,

Try

 index.... ... earliest=-1mon EventType="Registered"
 | timechart span=2w count(device_name) as device_count
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@alc2019,

Try

 index.... ... earliest=-1mon EventType="Registered"
 | timechart span=2w count(device_name) as device_count
Happy Splunking!
0 Karma

alc2019
New Member

Hi Renjith,

Thanks for the help but it will not work on my case as those devices register multiple times in a day and I have to count the registration based on their latest registration time.

Thanks

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@alc2019,
What about

      index.... ... earliest=-1mon EventType="Registered"
     |stats latest(_time) as _time by device_name
      | timechart span=2w count(device_name) as device_count
Happy Splunking!
0 Karma

alc2019
New Member

Perfect - works!

Thank you

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...