https://community.splunk.com/t5/Splunk-Dev/Grouping-Aggregate-Queries-Together/m-p/19056#M122 <P>This seems to work, but is there a better way? Would <CODE>selfjoin</CODE>, <CODE>timechart</CODE>, or <CODE>buckets</CODE> be a better approach?</P> <PRE> index="myIndex" host=myHost daysago=30 | stats Count as 30Days by username | join username [search index="myIndex" host=myHost daysago=60 | stats Count as 60Days by username] | join username [search index="myIndex" host=myHost daysago=90 | stats Count as 90Days by username] | join username [search index="myIndex" host=myHost daysago=120 | stats Count as 120Days by username]| fields username, 30Days, 60Days, 90Days, 120Days </PRE> Wed, 31 Oct 2012 21:33:40 GMT slierninja 2012-10-31T21:33:40Z https://community.splunk.com/t5/Splunk-Dev/Grouping-Aggregate-Queries-Together/m-p/19055#M121 <P>We want a grouping query showing user activity (<EM>page views</EM>) using a sliding window. What is the best way to build the query?</P> <P>We would like to join the results of the following queries, but present the results as one set.</P> <P><STRONG>index="myIndex" host=myHost daysago=30 | stats Count by username</STRONG><BR /><BR /> <STRONG>index="myIndex" host=myHost daysago=60 | stats Count by username</STRONG><BR /><BR /> <STRONG>index="myIndex" host=myHost daysago=90 | stats Count by username</STRONG><BR /><BR /> <STRONG>index="myIndex" host=myHost daysago=120 | stats Count by username</STRONG><BR /></P> <P>The output would look like...<BR /> <BR /></P> <H3>Page Views by User in Last xx Days</H3> <PRE> +--------+--------+---------+---------+----------+ | User | 30 Day | 60 Days | 90 Days | 120 Days | +--------+--------+---------+---------+----------+ | James | 40 | 55 | 85 | 90 | | Janet | 10 | 25 | 30 | 60 | | Walter | 0 | 15 | 25 | 45 | +--------+--------+---------+---------+----------+ </PRE> Wed, 31 Oct 2012 20:58:28 GMT https://community.splunk.com/t5/Splunk-Dev/Grouping-Aggregate-Queries-Together/m-p/19055#M121 slierninja 2012-10-31T20:58:28Z https://community.splunk.com/t5/Splunk-Dev/Grouping-Aggregate-Queries-Together/m-p/19056#M122 <P>This seems to work, but is there a better way? Would <CODE>selfjoin</CODE>, <CODE>timechart</CODE>, or <CODE>buckets</CODE> be a better approach?</P> <PRE> index="myIndex" host=myHost daysago=30 | stats Count as 30Days by username | join username [search index="myIndex" host=myHost daysago=60 | stats Count as 60Days by username] | join username [search index="myIndex" host=myHost daysago=90 | stats Count as 90Days by username] | join username [search index="myIndex" host=myHost daysago=120 | stats Count as 120Days by username]| fields username, 30Days, 60Days, 90Days, 120Days </PRE> Wed, 31 Oct 2012 21:33:40 GMT https://community.splunk.com/t5/Splunk-Dev/Grouping-Aggregate-Queries-Together/m-p/19056#M122 slierninja 2012-10-31T21:33:40Z