https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/559897#M159099 <P>Hi&nbsp;@Anonymous&nbsp;<BR /><BR />Try use foreach :</P><LI-CODE lang="markup">| makeresults 1 | eval Su=2 | eval M=2 | eval Tu=2 | eval W=2 | eval Th=2 | eval F=3 | eval Sa=3 | eval total=0 | foreach Su,M,Tu,W,Th,F,Sa [ eval total=total+&lt;&lt;FIELD&gt;&gt;]</LI-CODE> Sat, 17 Jul 2021 11:02:09 GMT efika 2021-07-17T11:02:09Z https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/559795#M159053 <P><SPAN>Hello,</SPAN></P><P><SPAN>i´m looking to get this result between each start /end time.</SPAN></P><P>hope you could help me <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P><P><SPAN>For example:</SPAN></P><TABLE border="0" width="720" cellspacing="0" cellpadding="0"><TBODY><TR><TD width="107px" height="15px">Start time</TD><TD width="103px" height="15px">Endtime</TD><TD width="72px" height="15px">Su</TD><TD width="72px" height="15px">M</TD><TD width="73px" height="15px">Tu</TD><TD width="73px" height="15px">W</TD><TD width="73px" height="15px">Th</TD><TD width="73px" height="15px">F</TD><TD width="73px" height="15px">Sa</TD></TR><TR><TD width="107px" height="15px"><SPAN>2021/07/01&nbsp;</SPAN></TD><TD width="103px" height="15px"><SPAN>2021/07/17</SPAN></TD><TD width="72px" height="15px">2</TD><TD width="72px" height="15px">2</TD><TD width="73px" height="15px">2</TD><TD width="73px" height="15px">2</TD><TD width="73px" height="15px">3</TD><TD width="73px" height="15px">3</TD><TD width="73px" height="15px">3</TD></TR><TR><TD width="107px" height="15px"><SPAN>2021/07/05</SPAN></TD><TD width="103px" height="15px">&nbsp;<SPAN>2021/07/20</SPAN></TD><TD width="72px" height="15px">2</TD><TD width="72px" height="15px">3</TD><TD width="73px" height="15px">3</TD><TD width="73px" height="15px">2</TD><TD width="73px" height="15px">2</TD><TD width="73px" height="15px">2</TD><TD width="73px" height="15px">2</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Thanks in advance</P> Fri, 16 Jul 2021 12:01:26 GMT https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/559795#M159053 cpm003 2021-07-16T12:01:26Z https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/559897#M159099 <P>Hi&nbsp;@Anonymous&nbsp;<BR /><BR />Try use foreach :</P><LI-CODE lang="markup">| makeresults 1 | eval Su=2 | eval M=2 | eval Tu=2 | eval W=2 | eval Th=2 | eval F=3 | eval Sa=3 | eval total=0 | foreach Su,M,Tu,W,Th,F,Sa [ eval total=total+&lt;&lt;FIELD&gt;&gt;]</LI-CODE> Sat, 17 Jul 2021 11:02:09 GMT https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/559897#M159099 efika 2021-07-17T11:02:09Z https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/559930#M159111 <LI-CODE lang="markup">| makeresults | eval _raw="start,end 2021/07/01,2021/07/17 2021/07/05,2021/07/20" | multikv forceheader=1 | table start end | eval start=strptime(start,"%Y/%m/%d") | eval end=strptime(end,"%Y/%m/%d") | eval days=floor((end-start)/(24*60*60))+1 | fieldformat start=strftime(start,"%Y/%m/%d") | fieldformat end=strftime(end,"%Y/%m/%d") | eval days=mvrange(1,days+1) | eval days=mvmap(days,start+((days-1)*24*60*60)) | eval days=mvmap(days,strftime(days,"%a")) | streamstats count as row | stats count by row start end days | eval dates=start."!".end | xyseries dates days count | eval start=mvindex(split(dates,"!"),0) | eval end=mvindex(split(dates,"!"),1) | fields - dates | table start end Sun Mon Tue Wed Thu Fri Sat</LI-CODE> Sun, 18 Jul 2021 09:52:35 GMT https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/559930#M159111 ITWhisperer 2021-07-18T09:52:35Z https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/559975#M159121 <P>Hello&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P><P>Seems to be working nice but i need print additional fields to this result such "Event ID",&nbsp; "Owner" , "Assigned Group", how could i&nbsp; get them?</P><P>thanks in advance</P> Mon, 19 Jul 2021 06:16:32 GMT https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/559975#M159121 cpm003 2021-07-19T06:16:32Z https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/560010#M159131 <P>You could use this as a subsearch on a join with your original data.</P> Mon, 19 Jul 2021 09:40:44 GMT https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/560010#M159131 ITWhisperer 2021-07-19T09:40:44Z https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/560016#M159134 <P>Thanks for you support, really appreciated</P> Mon, 19 Jul 2021 10:26:01 GMT https://community.splunk.com/t5/Splunk-Search/Need-calculate-a-count-of-each-quot-Su-M-Tu-W-Th-F-Sa-quot/m-p/560016#M159134 cpm003 2021-07-19T10:26:01Z