topic Re: Multiple stats command in Splunk Search

Multiple stats command

lkslsaks — Tue, 20 Jul 2021 12:12:56 GMT

bin _time span=1h | stats count(eval(eventDay==curDay)) AS cv by uid | stats count(eval(eventDay!=curDay)) AS ce by _time, uid

The following commands returns with null value in "cv" @Lowell @Hazel @ramdaspr @ITWhisperer

kamlesh_vaghela — Tue, 20 Jul 2021 04:26:31 GMT

Your second stats will not work. Because after 1st stats there will be only cv and uid fields available in results.

bin _time span=1h | stats count(eval(eventDay==curDay)) AS cv by uid

The second stats required eventDay,curDay,_time and uid. That's Y you are not getting any results.

| stats count(eval(eventDay!=curDay)) AS ce by _time, uid

Please share the logic or steps for your search. So we can help you on.

ITWhisperer — Tue, 20 Jul 2021 06:37:44 GMT

Is this what you are trying to do - if not, please explain what you are attempting to do (not just what doesn't work)

bin _time span=1h | stats count(eval(eventDay==curDay)) AS cv count(eval(eventDay!=curDay)) AS ce by _time, uid