topic Re: Event count from 2 dates in Splunk Search

Event count from 2 dates

ataunk — Fri, 29 Mar 2019 03:33:31 GMT

How do we get event count from 2 dates. Something like this -

              2/11/18            3/11/18           4/11/18

Event1 12 15 10
Event2 50 60 78

index =ind_prod...|eval abctime=strptime(abctime, "%Y-%m-%d") | search abctime>=$t.earliest$ AND abctime=$t.latest$

I tried above query, but it is not working

Re: Event count from 2 dates

renjith_nair — Sat, 30 Mar 2019 09:16:18 GMT

@ataunk ,

index =ind_prod|eval date=strftime(_time,"%Y-%m-%d")|chart count over event_name by date

where event_name is field name of your events

Re: Event count from 2 dates

woodcock — Sun, 31 Mar 2019 17:22:07 GMT

You have not shown us what the events look like (where abctime is).

Re: Event count from 2 dates

woodcock — Sun, 31 Mar 2019 17:28:00 GMT

Assuming that your conversion of abctime is correct (A BIG ASSUMPTION) and your other field is called Event (a guess), try this (you were missing a < for one thing):

index =ind_prod...
| eval abctime=strptime(abctime, "%Y-%m-%d")
| search abctime>=$t.earliest$ AND abctime<=$t.latest$
| bin _time span=1d
| eval _time = strftime(_time, "%m/%d/%Y")
| chart count BY event _time

Re: Event count from 2 dates

ataunk — Wed, 31 Jul 2019 18:13:11 GMT

instead of abctime we can take _time

Re: Event count from 2 dates

ataunk — Wed, 31 Jul 2019 18:15:25 GMT

This will give for all the days selected in time range, I want for specific 2 date, something like this

31-Jul 24-Jul

SessionCount 100000 150000

X Count 2000 2200

Y Count 100 200

Re: Event count from 2 dates

ataunk — Wed, 31 Jul 2019 18:16:11 GMT

I want count for 2 specific date, something like this :
31-Jul 24-Jul
SessionCount 100000 150000
X Count 2000 2200
Y Count 100 200

Re: Event count from 2 dates

woodcock — Sat, 23 Nov 2019 20:49:08 GMT

You have said that several times. Show us a few RAW EVENTS, note what fields are where inside of tohse events, and then show us a mockup of the final output that would be generated from JUST those events.

Re: Event count from 2 dates

woodcock — Sat, 23 Nov 2019 20:52:10 GMT

If you need 2 specific dates, then just set your Time picker to cover that timespan.