https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487401#M193827 <P>Hello</P> <P>below is my actual quiry</P> Wed, 18 Sep 2019 09:11:21 GMT Gowtham0809 2019-09-18T09:11:21Z https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487397#M193823 <P>Hi,</P> <P>I am joining several source files in splunk to degenerate some total count. One thing to note is I am using ctcSalt= to reindex all my source file to day, as only very few files will be chnaged when compared to other and i need to reindex all the files as per my usecase. </P> <P>Here I start using | stats count | timechart span=1d count(field) at the end of of the string and it does not provide any results, i also tries xyseries still no results.</P> <P>How do i span the results for each day?</P> Wed, 18 Sep 2019 07:27:36 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487397#M193823 Gowtham0809 2019-09-18T07:27:36Z https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487398#M193824 <P>timechart requires a _time field. For example, the daily count is:</P> <PRE><CODE>(your search)|timechart span=1d count </CODE></PRE> Wed, 18 Sep 2019 07:37:22 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487398#M193824 HiroshiSatoh 2019-09-18T07:37:22Z https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487399#M193825 <P>Hello, </P> <P>I am able to generate the single day count by adding (my search)| stats count, but if use (my search) |timechart span=1d count or (my search) | stats count |timechart span=1d count, I am not gettting any results and provided time range is all time.</P> Wed, 18 Sep 2019 07:44:22 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487399#M193825 Gowtham0809 2019-09-18T07:44:22Z https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487400#M193826 <P>(my search)| stats count<BR /> (my search) |timechart span=1d count <BR /> The top moves but the bottom doesn't move, you can only think of deleting ”_time”. Please provide a complete search statement.</P> <P>(my search) | stats count |timechart span=1d count,<BR /> →This doesn't work</P> Wed, 18 Sep 2019 08:39:05 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487400#M193826 HiroshiSatoh 2019-09-18T08:39:05Z https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487401#M193827 <P>Hello</P> <P>below is my actual quiry</P> Wed, 18 Sep 2019 09:11:21 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487401#M193827 Gowtham0809 2019-09-18T09:11:21Z https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487402#M193828 <PRE><CODE> |table TestCaseName,SysReqID,TestCaseID,Verdict,CurrentTestcaseResultURL </CODE></PRE> <P>You can't use "timechart" here because "_time" is gone.</P> <P>Also, due to "dedup", there will be only the latest one for each "CurrentTestcaseResultURL".</P> Thu, 19 Sep 2019 04:50:56 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487402#M193828 HiroshiSatoh 2019-09-19T04:50:56Z https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487403#M193829 <P>Thanks for your reply. And Yes, we use dedup to fecth only the latest url for each day. Thats why we re-index the data every day. is there any other way to get the historical trend for this search on daily basis?</P> Thu, 19 Sep 2019 05:02:12 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487403#M193829 Gowtham0809 2019-09-19T05:02:12Z https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487404#M193830 <P>For example, how about setting the "target date" so that it is always included in DEDUP, JOIN, and STATS?</P> <PRE><CODE>|eval target_date=strftime(_time,"%Y-%m-%d") EX. index="usa_*_test"・・・ ・・・|join type=inner DNGProjectAreaID,target_date ・・・|dedup LinkStartID,target_date ・・・|stats count by target_date </CODE></PRE> <P>・・・・・・・</P> Thu, 19 Sep 2019 06:05:39 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487404#M193830 HiroshiSatoh 2019-09-19T06:05:39Z https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487405#M193831 <P>Thanks for the update, I managed to come up with a solution by scheduling the report to generate a csv and append the same everyday to reach by visualization destination. I will also try out your opinion. Thanks</P> Thu, 19 Sep 2019 06:35:39 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-produce-results-with-a-span-of-1-day/m-p/487405#M193831 Gowtham0809 2019-09-19T06:35:39Z