topic Getting the counts by day but keeping the timestamp in Splunk Search

Getting the counts by day but keeping the timestamp

totaro — Tue, 30 Apr 2019 02:06:30 GMT

Hi,
Messing with dns logs im trying to get the domain that was only queried afew times per day. However i would also like to keep the timestamp so i know the time of query as well, any way i can do this? my current method is
"|stats count by Date,Query|where count < 5 " but this remove the timestamp

Re: Getting the counts by day but keeping the timestamp

MuS — Tue, 30 Apr 2019 03:50:45 GMT

Hi totaro,

try something like this:

base search here
| stats count values(timestamp) AS timestamp by Date, Query
| where count < 5

this will keep a single or multivalve field with the timestamp in it.

Hope this helps ...

cheers, MuS

Re: Getting the counts by day but keeping the timestamp

woodcock — Tue, 30 Apr 2019 04:52:32 GMT

Try these:

... | eventstats count BY Date Query | where count < 5

...  | stats count list(_time) AS _time BY Date Query | where count < 5