https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-group-dates/m-p/460158#M191305 <PRE><CODE>| stats values(Country) as Country sum(Price) as Price by Date City </CODE></PRE> Fri, 23 Aug 2019 04:11:06 GMT nareshinsvu 2019-08-23T04:11:06Z https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-group-dates/m-p/460157#M191304 <P>I have 4 columns of data:</P> <PRE><CODE>Country City Date Price </CODE></PRE> <P>I want to make a table where the <CODE>Price</CODE> column is is summed for each day for a particular City</P> <P>Example raw data:</P> <PRE><CODE>Country City Date Price a1 b1 2019-01-01 5 a1 b2 2019-01-01 3 a2 c1 2019-01-02 4 a2 c1 2019-01-02 7 a2 c2 2019-01-02 2 </CODE></PRE> <P>Desired Output (only the <CODE>Price</CODE> in city c1 is summed because it has 2 entries on the same date):</P> <PRE><CODE>Country City Date Price a1 b1 2019-01-01 5 a1 b2 2019-01-01 3 a2 c1 2019-01-02 11 a2 c2 2019-01-02 2 </CODE></PRE> <P>I have tried using <CODE>eventstats sum(Price) as newPrice by Date</CODE> but it gives weird number for the new column. </P> <P>I would appreciate any and all help! Please and thank you!</P> Fri, 23 Aug 2019 02:53:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-group-dates/m-p/460157#M191304 viandyg 2019-08-23T02:53:37Z https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-group-dates/m-p/460158#M191305 <PRE><CODE>| stats values(Country) as Country sum(Price) as Price by Date City </CODE></PRE> Fri, 23 Aug 2019 04:11:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-group-dates/m-p/460158#M191305 nareshinsvu 2019-08-23T04:11:06Z