https://community.splunk.com/t5/Splunk-Enterprise/Windows-event-log-by-days/m-p/367637#M1091 <P>Hi @sekil,</P> <P>Please try</P> <PRE><CODE>source="WinEventLog:Application"| bucket _time span=1d | stats count by _time </CODE></PRE> Thu, 28 Dec 2017 14:01:48 GMT harsmarvania57 2017-12-28T14:01:48Z https://community.splunk.com/t5/Splunk-Enterprise/Windows-event-log-by-days/m-p/367636#M1090 <P>Hi,<BR /> I want to view windows event log by days - how many event happend in each day. Try to use this search:<BR /> source="WinEventLog:Application" | stats count by _time<BR /> - but display all events and not group by day.</P> <P>Tell me please, what i need to change?</P> <P>Thanks.</P> Thu, 28 Dec 2017 08:29:44 GMT https://community.splunk.com/t5/Splunk-Enterprise/Windows-event-log-by-days/m-p/367636#M1090 sekii 2017-12-28T08:29:44Z https://community.splunk.com/t5/Splunk-Enterprise/Windows-event-log-by-days/m-p/367637#M1091 <P>Hi @sekil,</P> <P>Please try</P> <PRE><CODE>source="WinEventLog:Application"| bucket _time span=1d | stats count by _time </CODE></PRE> Thu, 28 Dec 2017 14:01:48 GMT https://community.splunk.com/t5/Splunk-Enterprise/Windows-event-log-by-days/m-p/367637#M1091 harsmarvania57 2017-12-28T14:01:48Z https://community.splunk.com/t5/Splunk-Enterprise/Windows-event-log-by-days/m-p/367638#M1092 <P>Try <CODE>source="WinEventLog:Application" | bucket span=1d _time | stats count by _time</CODE></P> Thu, 28 Dec 2017 14:06:15 GMT https://community.splunk.com/t5/Splunk-Enterprise/Windows-event-log-by-days/m-p/367638#M1092 richgalloway 2017-12-28T14:06:15Z