https://community.splunk.com/t5/Splunk-Search/How-can-I-write-a-seach-to-get-count-of-each-application-per-day/m-p/361751#M106860 <P>Try this ...</P> <PRE><CODE> index=index1 ...| bin span=1d _time | stats count as appcount by _time app. </CODE></PRE> Thu, 10 Aug 2017 15:57:44 GMT DalJeanis 2017-08-10T15:57:44Z https://community.splunk.com/t5/Splunk-Search/How-can-I-write-a-seach-to-get-count-of-each-application-per-day/m-p/361750#M106859 <P>I am looking for a search to get a count of each application per day. Below is the search I have now, which gives count for everything for that day. I need count per application per day.</P> <PRE><CODE>index=index1 ...| bin span=1d _time | stats values(app) count(app) by _time </CODE></PRE> <P>The result I get is below:</P> <PRE><CODE>08/10/17 app1, app2, app3 total count of all 3 apps. </CODE></PRE> <P>But what I want is this:</P> <PRE><CODE>08/10/17 app1 count of app1 app2 count of app2 </CODE></PRE> Thu, 10 Aug 2017 15:39:50 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-write-a-seach-to-get-count-of-each-application-per-day/m-p/361750#M106859 knarayana 2017-08-10T15:39:50Z https://community.splunk.com/t5/Splunk-Search/How-can-I-write-a-seach-to-get-count-of-each-application-per-day/m-p/361751#M106860 <P>Try this ...</P> <PRE><CODE> index=index1 ...| bin span=1d _time | stats count as appcount by _time app. </CODE></PRE> Thu, 10 Aug 2017 15:57:44 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-write-a-seach-to-get-count-of-each-application-per-day/m-p/361751#M106860 DalJeanis 2017-08-10T15:57:44Z https://community.splunk.com/t5/Splunk-Search/How-can-I-write-a-seach-to-get-count-of-each-application-per-day/m-p/361752#M106861 <P>It is the <CODE>count(app)</CODE> thing that gets everybody. What we all should understand (and what is not taught anywhere) is that <CODE>count(app)</CODE> is actually <CODE>count(eval(isnotnull(app)))</CODE> which in the vast majority if cases simplifies down to being just <CODE>count</CODE>.</P> Thu, 10 Aug 2017 16:12:00 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-write-a-seach-to-get-count-of-each-application-per-day/m-p/361752#M106861 woodcock 2017-08-10T16:12:00Z https://community.splunk.com/t5/Splunk-Search/How-can-I-write-a-seach-to-get-count-of-each-application-per-day/m-p/361753#M106862 <P>Yeah, I avoid <CODE>()</CODE> with <CODE>count</CODE> whenever I can, especially when typing aircode. Figuring out what quotes are needed for evals in there is nontrivial at the moment. Write many, test many, post... well, usually twice...</P> Thu, 10 Aug 2017 16:16:44 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-write-a-seach-to-get-count-of-each-application-per-day/m-p/361753#M106862 DalJeanis 2017-08-10T16:16:44Z