topic how to calculate multiple stats count? in Splunk Search https://community.splunk.com/t5/Splunk-Search/how-to-calculate-multiple-stats-count/m-p/66599#M16573 <P>i have following data</P> <PRE><CODE>playdate, adid, store, 2011-08-23, 1 , s1 2011-08-23, 2, s2 2011-08-23, 1, s2 2011-08-25, 2, s2 </CODE></PRE> <P>i need to calculate calculate:</P> <P>How many time each <CODE>adid</CODE> played on each <CODE>playdate</CODE></P> <P>and in how many stores the <CODE>adid</CODE> played on each <CODE>playdate</CODE> </P> <PRE><CODE>adid playdate #of plays on each day #of stores play on each day 1 2011-08-23 2 2 2 2011-08-23 1 1 2 2011-08-25 1 1 </CODE></PRE> <P>Here is what i tried but no data returned</P> <PRE><CODE>search..|stats count BY adid, playdate| stats sum BY adid, playdate, store </CODE></PRE> <P>hope i explain properly</P> <P>thanks</P> Mon, 29 Aug 2011 22:43:15 GMT desi 2011-08-29T22:43:15Z how to calculate multiple stats count? https://community.splunk.com/t5/Splunk-Search/how-to-calculate-multiple-stats-count/m-p/66599#M16573 <P>i have following data</P> <PRE><CODE>playdate, adid, store, 2011-08-23, 1 , s1 2011-08-23, 2, s2 2011-08-23, 1, s2 2011-08-25, 2, s2 </CODE></PRE> <P>i need to calculate calculate:</P> <P>How many time each <CODE>adid</CODE> played on each <CODE>playdate</CODE></P> <P>and in how many stores the <CODE>adid</CODE> played on each <CODE>playdate</CODE> </P> <PRE><CODE>adid playdate #of plays on each day #of stores play on each day 1 2011-08-23 2 2 2 2011-08-23 1 1 2 2011-08-25 1 1 </CODE></PRE> <P>Here is what i tried but no data returned</P> <PRE><CODE>search..|stats count BY adid, playdate| stats sum BY adid, playdate, store </CODE></PRE> <P>hope i explain properly</P> <P>thanks</P> Mon, 29 Aug 2011 22:43:15 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-multiple-stats-count/m-p/66599#M16573 desi 2011-08-29T22:43:15Z Re: how to calculate multiple stats count? https://community.splunk.com/t5/Splunk-Search/how-to-calculate-multiple-stats-count/m-p/66600#M16574 <P>Assuming the 'playdate' time is getting recognized by Splunk and used as the index time, then I think this is what you're looking for: </P> <PRE><CODE>&lt;search...&gt; | bin _time span="1d" | stats dc(adid) dc(store) by adid, _time </CODE></PRE> Mon, 29 Aug 2011 23:53:50 GMT https://community.splunk.com/t5/Splunk-Search/how-to-calculate-multiple-stats-count/m-p/66600#M16574 sideview 2011-08-29T23:53:50Z