Splunk Search

plotting unique values using timecharts

chan2
Engager

Hi,

I'd like to draw a quick chart of unique instances of a given field over time. Specifically, I'd like a chart with:
x-axis: time in increments of days or hours
y-axis: number of unique users as defined by the field 'userid'
So regardless of how many userids appear on a given day, the chart would only display a single line with the number of unique userids.

I tried the following query, but it does not provide the above:
* | timechart count by unique(userid)

A sample log event would be:
event userid=X

Tags (2)
1 Solution

jonuwz
Influencer

You need

... | timechart span=1d dc(userid)

Where dc = distinct count.

View solution in original post

jonuwz
Influencer

You need

... | timechart span=1d dc(userid)

Where dc = distinct count.

yoho
Contributor

Don't know enough about Splunk to tell you exactly what to do, but I would use summary indexes. You need in a field the value you're trying to plot and if I understand well, you don't have this value anywhere in your log files. So you should run a summary search every day or every hour which is counting the number of unique user ids since the previous time the summary search was run. Once you get this result, it will be easy to plot what you need.

To get your summary index, you will have to extract your "userid" field (with multikv ?) and then pipe this through the "uniq" command and count the results.

Hope that helps.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...