Splunk Search

need value by time

splunkuseradmin
Path Finder

hello I have a command which gives the value ex., "172" it is basically change when no. of ldap users added and removed I need to get the value by time. where there is no logs generated by time or some thing like that its just a total number which we can see ...
-So the question is, is there any way we can get by time like if we run a dashboard we get these fields and count by week or something.

it basically gives the fields
Host.....User........count.......port
ccm.corp.exp.com......sideview-cdr........172.......8443

Tags (1)
0 Karma

PowerPacked
Builder

Hi

are you looking timechart command, this will plot a chart for every time span.

yourquery | timechart span=1h count(yourfieldname)

change the span to others like 1m,5m,1h,1d etc

& take a look at this timechart command doc

https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Timechart

Thanks

0 Karma

splunkuseradmin
Path Finder

thank you for replying but timechart command is not working as there are no logs.
basically using api's to get values.

0 Karma

PowerPacked
Builder

It should return time field other wise you cant plot chart or not even know when that specific value happened or changed

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...