topic Re: can we get 4 different fields count per hour in Splunk Search

can we get 4 different fields count per hour

snallam123 — Thu, 09 Jan 2020 22:33:29 GMT

I am trying to get count of four fields [ company_name companyID CustomerId Provider] by each hour

index=IndexName 
| bin span=1h _time 
| stats count by company_name companyID CustomerId Provider _time 
| sort 0 _time 
| eval results= 'companyName'+" : "+'companyID'+" : "+'CustomerId'+" : "+'Provider'
| eval time=strftime(_time,"%m-%d-%Y--%H-%M-%S") 
| table results time count 
| xyseries results time count 
| rex field=results "(?<companyName>.+):(?<companyID>.+):(?<CustomerId>.+):(?<Provider>.+)"
| table  company_name companyID CustomerId Provider * 
| addcoltotals labelfield=company_name label="Total_count"
| fields - count results

I am able to get results like i need, But i am pretty sure this search isn't the good way to do it.

Expected results:

company_name companyID CustomerId   Provider 12:00 01:00 02:00 03:00 04:00 ---
  Apple        1234       vgs31982   pro-1     10    20    30    40   10 
  google       567        kjf733     pro-2     11    11    33    83    20
 Total_count                                   21    31    63    123   30

can some help me on this.

Re: can we get 4 different fields count per hour

to4kawa — Fri, 10 Jan 2020 13:35:06 GMT

index=IndexName 
| eval results= 'companyName'+" : "+'companyID'+" : "+'CustomerId'+" : "+'Provider' 
| timechart span=1h count by results
| eval time=strftime(_time,"%H:%M") 
| table results time count 
| xyseries results time count 
| addcoltotals labelfield=results label="Total_count"
| rex field=results "(?<companyName>.+):(?<companyID>.+):(?<CustomerId>.+):(?<Provider>.+)" 
| table company_name companyID CustomerId Provider *
| fields - count results
| fillnull company_name value="Total_count"

Re: can we get 4 different fields count per hour

snallam123 — Fri, 10 Jan 2020 16:10:03 GMT

Actually my query is working fine, I am just looking for a different approach without combining all fields.
I can't accept this answer, I don't see any difference from what my question is..

Re: can we get 4 different fields count per hour

to4kawa — Fri, 10 Jan 2020 18:45:05 GMT

If that is the case, you will need to show us a sample log.