topic Re: How to get stats by month? in Splunk Search

How to get stats by month?

SS1 — Mon, 22 Aug 2022 22:59:54 GMT

Hi,

I have my current search giving below output, I want to have stats listed by Month. Can someone help on this one

Current Search: my search | eval True=(total1-total2) | eval False=round(False/(True+False)*100,2) | table False

Output: False

42.12

Desired Output:

Month False

August 42.12

July xx.xx

june xx.xx

Re: How to get stats by month?

ITWhisperer — Mon, 22 Aug 2022 22:35:47 GMT

| bin _time span=1mon

Re: How to get stats by month?

SS1 — Mon, 22 Aug 2022 23:01:35 GMT

It still doesn't give monthly stats, still shows just the value

Re: How to get stats by month?

bowesmana — Mon, 22 Aug 2022 23:39:20 GMT

with bin command, you would normally then use "stats xxxx by _time" to then group values according to the month and then you do your true/false calculations on that.

What is in 'my search' part of your search?

Re: How to get stats by month?

SS1 — Mon, 22 Aug 2022 23:45:58 GMT

My search

Re: How to get stats by month?

bowesmana — Tue, 23 Aug 2022 04:43:52 GMT

OK, without knowing your data, I would suggest that using appendcols is not the best way to approach the problem. I am not sure why you are deduping _time.

You have events in index=action that can have

a) any ONE of the 3 possible (True, [Home], False)
b) one or more of (True, [Home], False)

and as you are deduping _time, it may be that you have more than one with the identical _time value

Depending on the answers to the above, this may be an option

A single search to collect all data. Some eval statements to determine the type of data you are looking at and then the bin of time for 1 month the stats by _time (i.e. 1 month)

Then the calculates for the True/Home/False values.

However, your reason for deduping _time is significant. If there is more than one T, H or F at _time and you want to disregard those, this is not right as it will count those twice.

You could add a

| stats max(T) as T max(H) as H max(F) as F by _time

before the | bin command to get either a 1 or 0 for time for each value of _time before you aggregate to 1 month.