https://community.splunk.com/t5/Splunk-Search/date-month-issue/m-p/76446#M19337 <P>"source="jun_jan.csv" | stats count by date_month" lists all months, but if I want to include another field like status ""source="jun_jan.csv" | stats count by date_month, STATUS" It lists only two months. Plese suggest how do we get the other field</P> <P>source="jun_jan.csv" | stats count by date_mont<BR /> date_month count<BR /><BR /> 1 august 2776 <BR /> 2 december 4602 <BR /> 3 january 5228 <BR /> 4 july 3533 <BR /> 5 november 5001 <BR /> 6 october 3357 <BR /> 7 september 4275 </P> <P>source="jun_jan.csv" | stats count by date_month, STATUS<BR /> date_month STATUS count<BR /><BR /> 1 august FAILED 262 <BR /> 2 august PASSED 2046 <BR /> 3 august WARNING_FAILED_STEP 23 <BR /> 4 august WARNING_FILTER 14 <BR /> 5 july FAILED 433 <BR /> 6 july NONE 1 <BR /> 7 july PASSED 3002 <BR /> 8 july WARNING_FAILED_STEP 76 <BR /> 9 july WARNING_FILTER 21 </P> Mon, 28 Sep 2020 11:25:55 GMT iamniks 2020-09-28T11:25:55Z https://community.splunk.com/t5/Splunk-Search/date-month-issue/m-p/76446#M19337 <P>"source="jun_jan.csv" | stats count by date_month" lists all months, but if I want to include another field like status ""source="jun_jan.csv" | stats count by date_month, STATUS" It lists only two months. Plese suggest how do we get the other field</P> <P>source="jun_jan.csv" | stats count by date_mont<BR /> date_month count<BR /><BR /> 1 august 2776 <BR /> 2 december 4602 <BR /> 3 january 5228 <BR /> 4 july 3533 <BR /> 5 november 5001 <BR /> 6 october 3357 <BR /> 7 september 4275 </P> <P>source="jun_jan.csv" | stats count by date_month, STATUS<BR /> date_month STATUS count<BR /><BR /> 1 august FAILED 262 <BR /> 2 august PASSED 2046 <BR /> 3 august WARNING_FAILED_STEP 23 <BR /> 4 august WARNING_FILTER 14 <BR /> 5 july FAILED 433 <BR /> 6 july NONE 1 <BR /> 7 july PASSED 3002 <BR /> 8 july WARNING_FAILED_STEP 76 <BR /> 9 july WARNING_FILTER 21 </P> Mon, 28 Sep 2020 11:25:55 GMT https://community.splunk.com/t5/Splunk-Search/date-month-issue/m-p/76446#M19337 iamniks 2020-09-28T11:25:55Z https://community.splunk.com/t5/Splunk-Search/date-month-issue/m-p/76447#M19338 <P>Look at the events that are in months, not displayed in the second result and see if the STATUS field is present there. The search <CODE>... | stats count by date_month,STATUS</CODE> will only show the result counts for events with both fields present.</P> Wed, 22 Feb 2012 16:13:16 GMT https://community.splunk.com/t5/Splunk-Search/date-month-issue/m-p/76447#M19338 ziegfried 2012-02-22T16:13:16Z https://community.splunk.com/t5/Splunk-Search/date-month-issue/m-p/76448#M19339 <P>For all the events there is a status as well as process field, </P> Thu, 23 Feb 2012 00:59:32 GMT https://community.splunk.com/t5/Splunk-Search/date-month-issue/m-p/76448#M19339 iamniks 2012-02-23T00:59:32Z https://community.splunk.com/t5/Splunk-Search/date-month-issue/m-p/76449#M19340 <P>is there a date_month field too for <EM>all</EM> of them?</P> Mon, 28 Sep 2020 11:26:43 GMT https://community.splunk.com/t5/Splunk-Search/date-month-issue/m-p/76449#M19340 ziegfried 2020-09-28T11:26:43Z