{"id":18502,"date":"2020-08-18T19:35:19","date_gmt":"2020-08-18T19:35:19","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=18502"},"modified":"2020-08-18T19:35:19","modified_gmt":"2020-08-18T19:35:19","slug":"how-to-timechart-possibly-better-than-timechart-in-splunk","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=18502","title":{"rendered":"how-to timechart [possibly] better than timechart in splunk"},"content":{"rendered":"

I recently had cause to do an extensive trellised<\/a> timechart<\/a> for a dashboard at $CUSTOMER in Splunk<\/a>.<\/p>\n

\n
\"\"\/<\/figure>\n<\/div>\n

They have a couple hundred locations reporting networked devices.<\/p>\n

I needed to report on how many devices they’ve reported every day over the last 90 days (I would have liked<\/em> to go back further…but retention is only 90 days on this data).<\/p>\n

My initial instinct was to do this:<\/h4>\n
\n
\n

index=ndx sourcetype=srctp site=* ip=* earliest=-90d
| timechart limit=0 span=1d dc(ip) by site<\/code><\/p>\n<\/div>\n<\/div>\n

Except…that takes well over<\/strong> an hour to run – so the job gets terminated at ~60 minutes.<\/p>\n

What possible other approaches could be made? <\/p>\n

\"?\"<\/h1>\n

Well. <\/p>\n

Here are a few that I thought about:<\/h4>\n
    \n
  1. Use multisearch<\/code><\/a>, and group 9 10d searches together.\n