topic Re: Unable to get field value wise segregation count through stats and timechart in Splunk Search

Field values

obularajud16 — Thu, 03 Sep 2020 04:25:45 GMT

Ghj

sourcetype=access_combined | eval action = if(isnull(action) OR action="", "Unknown", action) | timechart span=40h values(action),count(action)

Re: Unable to get field value wise segregation count through stats and timechart

to4kawa — Sat, 29 Aug 2020 09:39:40 GMT

sourcetype=access_combined | eval action = if(isnull(action) OR action="", "Unknown", action) | timechart span=40h count by action

Re: Unable to get field value wise segregation count through stats and timechart

obularajud16 — Sat, 29 Aug 2020 11:27:43 GMT

As I mentioned, i need data in row format not in column format to group by multiple fields

timechart span=40h count by action, status

Re: Unable to get field value wise segregation count through stats and timechart

isoutamo — Sat, 29 Aug 2020 12:08:16 GMT

Easiest way is combine those values like:

eval a_s = action . "-".status

| timechart span=40h count by a_s

Otherwise you must start to play with bin + stats/chart/xyseries

r. Ismo

Re: Unable to get field value wise segregation count through stats and timechart

thambisetty — Sat, 29 Aug 2020 16:19:07 GMT

sourcetype=access_combined | eval action = if(isnull(action) OR action="", "Unknown", action) | bin _time span=40h | chart count over _time by action

Re: Unable to get field value wise segregation count through stats and timechart

obularajud16 — Sun, 30 Aug 2020 06:52:32 GMT

Got the answer with the below

sourcetype=access_combined | eval action = if(isnull(action) OR action="", "unknown", action) | bin span=72h _time | stats count as totals by action, span(=_time,72h) | sort -_time,action