https://community.splunk.com/t5/Splunk-Search/count-of-a-field-and-then-sort-by-day/m-p/497213#M138501 <P>@barneser </P> <P>Can you please share more details with sample output?? meanwhile can you please try this ?</P> <P><CODE>index=profile_new | chart count(cn1) over date_mday by cs2 | sort date_mday</CODE></P> Thu, 05 Dec 2019 12:12:51 GMT kamlesh_vaghela 2019-12-05T12:12:51Z https://community.splunk.com/t5/Splunk-Search/count-of-a-field-and-then-sort-by-day/m-p/497211#M138499 <P>Im looking to count by a field and that works with first part of syntex , then sort it by date.<BR /> both work independantly ,but not together.</P> <P>Any ideas?</P> <P>index=profile_new| stats count(cn1) by cs2 | stats count as daycount by date_mday</P> Wed, 30 Sep 2020 03:11:31 GMT https://community.splunk.com/t5/Splunk-Search/count-of-a-field-and-then-sort-by-day/m-p/497211#M138499 barneser 2020-09-30T03:11:31Z https://community.splunk.com/t5/Splunk-Search/count-of-a-field-and-then-sort-by-day/m-p/497212#M138500 <P>Hi @barneser,<BR /> after a stats command, you have only the fields that you used in the stats command.<BR /> So in your example, after the first stats command you have only count(cn1) and cs2, you haven't more date_mday or other fields.<BR /> If you need another field you have to add it to stats command using values or earliest (for dates).<BR /> For more infos see at <A href="https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Stats">https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Stats</A> .</P> <P>Anyway, if you could describe better what you want to have as result, I could help you, because I don't understand your requisite.</P> <P>In other words, if you run a statistic for cs2, what do you mean with "sort by date"?</P> <P>Ciao.<BR /> Giuseppe</P> Thu, 05 Dec 2019 12:11:07 GMT https://community.splunk.com/t5/Splunk-Search/count-of-a-field-and-then-sort-by-day/m-p/497212#M138500 gcusello 2019-12-05T12:11:07Z https://community.splunk.com/t5/Splunk-Search/count-of-a-field-and-then-sort-by-day/m-p/497213#M138501 <P>@barneser </P> <P>Can you please share more details with sample output?? meanwhile can you please try this ?</P> <P><CODE>index=profile_new | chart count(cn1) over date_mday by cs2 | sort date_mday</CODE></P> Thu, 05 Dec 2019 12:12:51 GMT https://community.splunk.com/t5/Splunk-Search/count-of-a-field-and-then-sort-by-day/m-p/497213#M138501 kamlesh_vaghela 2019-12-05T12:12:51Z