Multiple File Indicator

zoebanning — Mon, 06 Dec 2021 01:53:22 GMT

Hello Splunk Community,

I have created a query to calculate the business date of the file which arrived to be loaded & the date/time it arrived, which outputs the following (dummy data used):

File	Business Date	Arrival Date	Arrival Time
File A	22-11-2021	06-12-2021	6.51
File B	22-11-2021	06-12-2021	6.55
File B	22-11-2021	06-12-2021	6.56

I want to create a new column which highlights if a file (with the same business date) arrived more than once on the same day. So for example the output would look like so:

File	Business Date	Arrival Date	Arrival Time	Count
File A	22-11-2021	06-12-2021	6.51	1
File B	22-11-2021	06-12-2021	6.55	2
File B	22-11-2021	06-12-2021	6.56	2

Can anyone help improving my query to include this new column?

Thanks,

Zoe

Re: Multiple File Indicator

manjunathmeti — Mon, 06 Dec 2021 03:54:28 GMT

hi @zoebanning,

You can use eventstats command to calculate count.

<your_existing_query> | eventstats count as Count by File, "Arrival Date"

Re: Multiple File Indicator

zoebanning — Mon, 06 Dec 2021 05:30:18 GMT

This worked perfectly. Thank You 🙂

topic Re: Multiple File Indicator in Splunk Search

Multiple File Indicator

Re: Multiple File Indicator

Re: Multiple File Indicator