topic Re: Splunk search for each month in Splunk Search

Splunk search for each month

jerinvarghese — Mon, 14 Sep 2020 12:17:59 GMT

HI All,

Need help in preparing a tabular form.

Data am having :

using the Index am getting below table.

Class	Count
NODEDOWN	520
BGPDOWN	320
ISISALERT	130

Query am using

index=itsm stats count by Class

Last 60 days data.

Requirement:

I want month wise data. I used timewrap and timechart. But the data am getting is not the correct format.

Expected format output.

Class	Jul-20	Aug-20	Sep-20
NODEDOWN	250	250	20
BGPDOWN	150	150	20
ISISALERT	50	50	30

Please help me this format,

If it search for 1 year data. all 12 months in tabular data.

Re: Splunk search for each month

thambisetty — Mon, 14 Sep 2020 12:36:46 GMT

index=itsm | bin span=1mon _time | eval month_Year = strftime(_time,"%b-%y") | chart count over Class by month_Year

Re: Splunk search for each month

jerinvarghese — Tue, 15 Sep 2020 11:44:42 GMT

HI,

My order is coming as below. how can i make it on order.

I tried above qury and that provides me output, but all the order is in alphabetical order not in the month wise order. its not useful data. Please help me get it in month wise order

Class	Aug-20	Jul-20	Sep-20
NODEDOWN	200	200	20