https://community.splunk.com/t5/Splunk-Enterprise-Security/Distinct-Count-combined-with-List/m-p/483478#M7844 <P>Kinda, but I want to list the results for each day within it's own row, if that makes sense. </P> <P>So that is display better, in a table with a row for Monday, then alongside it listed the count by urgency.</P> Wed, 15 Jan 2020 16:32:26 GMT jacqu3sy 2020-01-15T16:32:26Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Distinct-Count-combined-with-List/m-p/483476#M7842 <P>Is it possible to take a distinct count of something, then list this by an additional value by day?</P> <P>something like the following but tweaked to display the count of events, by urgency on specific days;</P> <P><CODE>notable</CODE> <BR /> | bucket _time span=1d<BR /> | stats dc(event_id) by urgency, _time</P> <P>The goal being a table that looks like the following;</P> <P>Monday Medium, 5<BR /> High, 7<BR /> Tuesday Low, 6<BR /> Medium, 10<BR /> High, 20<BR /> etc etc</P> <P>Thanks.</P> Wed, 30 Sep 2020 03:39:52 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Distinct-Count-combined-with-List/m-p/483476#M7842 jacqu3sy 2020-09-30T03:39:52Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Distinct-Count-combined-with-List/m-p/483477#M7843 <P>Hi @jacqu3sy:</P> <P>can you try this please:</P> <PRE><CODE>notable | bucket _time span=1d | stats dc(event_id) by date_wday, urgency </CODE></PRE> Wed, 15 Jan 2020 16:16:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Distinct-Count-combined-with-List/m-p/483477#M7843 TISKAR 2020-01-15T16:16:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Distinct-Count-combined-with-List/m-p/483478#M7844 <P>Kinda, but I want to list the results for each day within it's own row, if that makes sense. </P> <P>So that is display better, in a table with a row for Monday, then alongside it listed the count by urgency.</P> Wed, 15 Jan 2020 16:32:26 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Distinct-Count-combined-with-List/m-p/483478#M7844 jacqu3sy 2020-01-15T16:32:26Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Distinct-Count-combined-with-List/m-p/483479#M7845 <PRE><CODE>notable | bucket _time span=1d | chart dc(event_id) by date_wday urgency | table date_wday, High, Medium, Low </CODE></PRE> <P>Hi, @jacqu3sy <BR /> Please use <CODE>chart</CODE>.<BR /> Finally, the order of the columns must be aligned.</P> Wed, 15 Jan 2020 18:09:17 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Distinct-Count-combined-with-List/m-p/483479#M7845 to4kawa 2020-01-15T18:09:17Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Distinct-Count-combined-with-List/m-p/483480#M7846 <P>great stuff. Many thanks.</P> Thu, 16 Jan 2020 12:39:33 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Distinct-Count-combined-with-List/m-p/483480#M7846 jacqu3sy 2020-01-16T12:39:33Z