https://community.splunk.com/t5/Splunk-Search/How-to-search-data-on-multiple-days-days-which-are-determined-by/m-p/426534#M122182 <P>Hi gibir,<BR /> let me know:<BR /> do you want to find the top three days and then use these dates in another search?</P> <P>if this is your need you could try someting like this</P> <PRE><CODE>index=my index | eval day=strftime(_time,"%Y-%m-%d") | search [ search index=potato | bin _time span=1d | stats sum(piece) AS sum_piece BY _time | sort -sum_piece | head 3 | eval day=strftime(_time,"%Y-%m-%d") | fields day ] | ... </CODE></PRE> <P>If you want to use the same time boundaries of the subsearhc in the main search you could use:</P> <PRE><CODE>index=my index [ search index=potato | bin _time span=1d | stats sum(piece) AS sum_piece BY _time | sort -sum_piece | head 3 | eval day=strftime(_time,"%Y-%m-%d") | stats earliest(day) AS earliest latest(day) AS latest values(day) AS day | fields earliest latest ] | eval day=strftime(_time,"%Y-%m-%d") | search [ search index=potato | bin _time span=1d | stats sum(piece) AS sum_piece BY _time | sort -sum_piece | head 3 | eval day=strftime(_time,"%Y-%m-%d") | fields day ] | ... </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Wed, 04 Jul 2018 14:38:07 GMT gcusello 2018-07-04T14:38:07Z https://community.splunk.com/t5/Splunk-Search/How-to-search-data-on-multiple-days-days-which-are-determined-by/m-p/426533#M122181 <P>I want to determine the top n days of a time period based on a criteria and then get some statistics only on those days.<BR /> Do I use a subsearch?<BR /> I can write the searches for these two things separately but I cannot link them. Also I don't know how to pass specific days as parameters to my search.</P> <P>I have something like this for determining the days:</P> <P>index=potato<BR /> | bin _time span=1d<BR /> | stats sum(piece) AS sum_piece BY _time<BR /> | sort -sum_piece<BR /> | head 3</P> <P>How can I pass this? Or is there a simpler solution?</P> <P>Thanks</P> Tue, 29 Sep 2020 20:19:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-data-on-multiple-days-days-which-are-determined-by/m-p/426533#M122181 gibir 2020-09-29T20:19:48Z https://community.splunk.com/t5/Splunk-Search/How-to-search-data-on-multiple-days-days-which-are-determined-by/m-p/426534#M122182 <P>Hi gibir,<BR /> let me know:<BR /> do you want to find the top three days and then use these dates in another search?</P> <P>if this is your need you could try someting like this</P> <PRE><CODE>index=my index | eval day=strftime(_time,"%Y-%m-%d") | search [ search index=potato | bin _time span=1d | stats sum(piece) AS sum_piece BY _time | sort -sum_piece | head 3 | eval day=strftime(_time,"%Y-%m-%d") | fields day ] | ... </CODE></PRE> <P>If you want to use the same time boundaries of the subsearhc in the main search you could use:</P> <PRE><CODE>index=my index [ search index=potato | bin _time span=1d | stats sum(piece) AS sum_piece BY _time | sort -sum_piece | head 3 | eval day=strftime(_time,"%Y-%m-%d") | stats earliest(day) AS earliest latest(day) AS latest values(day) AS day | fields earliest latest ] | eval day=strftime(_time,"%Y-%m-%d") | search [ search index=potato | bin _time span=1d | stats sum(piece) AS sum_piece BY _time | sort -sum_piece | head 3 | eval day=strftime(_time,"%Y-%m-%d") | fields day ] | ... </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Wed, 04 Jul 2018 14:38:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-data-on-multiple-days-days-which-are-determined-by/m-p/426534#M122182 gcusello 2018-07-04T14:38:07Z