topic Re: How do I display the date in my report with the the data ? in Splunk Search

How do I display the date in my report with the the data ?

pradeepk50 — Thu, 12 Mar 2020 10:20:29 GMT

I am trying get the max count for the yesterday's but along with this i need to display the date in the report for yesterdays date?
Kindly help me to get the date in the results along with the existing results.

Query: sourcetype="x" name = "any" | bin _time span=1s | stats count by logtime | stats max(count)

Output for the above query is :
max(count)
34

Thanks In Advance

Re: How do I display the date in my report with the the data ?

richgalloway — Thu, 12 Mar 2020 12:37:09 GMT

The stats command filters out all fields except those explicitly named in the command so _time is not available. Depending on the time window of your search, this may fill your needs.

sourcetype="x" name = "any" | bin _time span=1s | stats count by logtime 
| stats max(count) as MaxCount 
| eval Date = strftime(now(), "%F")
| table Date MaxCount

Re: How do I display the date in my report with the the data ?

manjunathmeti — Thu, 12 Mar 2020 12:38:29 GMT

Try this,

sourcetype="x" name = "any" | bin _time span=1s | stats count by logtime | eventstats max(count) as count | eval date=strftime(now()-86400, "%d-%m-%Y")

Re: How do I display the date in my report with the the data ?

pradeepk50 — Thu, 12 Mar 2020 15:23:06 GMT

Perfect 🙂

so to get the date field this is the syntax " | eval Date = strftime(now(), "%F")" right ?

Re: How do I display the date in my report with the the data ?

pradeepk50 — Thu, 12 Mar 2020 15:25:08 GMT

by this i am getting count for that interval. Actually i am looking for complete day Max count with the date incorporated in that.

Re: How do I display the date in my report with the the data ?

manjunathmeti — Thu, 12 Mar 2020 15:30:52 GMT

what are logtime values?

Re: How do I display the date in my report with the the data ?

pradeepk50 — Thu, 12 Mar 2020 15:55:03 GMT

Its like

logtime
for todays date and time --> the count will get displayed.

Like below
logtime count
2020-03-11 19:38:42 34
2020-03-11 17:30:53 29
2020-03-11 19:17:02 29
2020-03-11 17:17:36 28

Re: How do I display the date in my report with the the data ?

richgalloway — Thu, 12 Mar 2020 16:57:43 GMT

Right. That will get you the current date as a string. Modify the second argument to strftime if you want the date in a different format.

Re: How do I display the date in my report with the the data ?

manjunathmeti — Thu, 12 Mar 2020 17:49:17 GMT

ok, you can use stats in place of eventstats. And you wrote need to display the date in the report for yesterdays date. Replace now()-86400 with now() if you don't want yesterdays date.

sourcetype="x" name = "any" | bin _time span=1s | stats count by logtime | stats max(count) as max_count | eval date=strftime(now()-86400, "%d-%m-%Y") | table date, max_count

Re: How do I display the date in my report with the the data ?

pradeepk50 — Fri, 13 Mar 2020 05:09:59 GMT

By the above query i am getting the date filed in the results but its getting today's date, but the report is running for yesterday's data. So we need to display yesterday's date.

Re: How do I display the date in my report with the the data ?

pradeepk50 — Fri, 13 Mar 2020 05:15:04 GMT

Yeah, this is working as expected.