https://community.splunk.com/t5/Splunk-Search/Problem-in-Search-Command/m-p/98847#M25497 <P>Hi,</P> <P>I wouldn't use the _time field in this case. If you want a time trend a sparkline can give you a good indication of when cases happened throughout the day. How about you summarize using something like</P> <P>search.. | stats sparkline sum(cases) as NoOfCases by location</P> Sun, 21 Jul 2013 05:41:11 GMT clymbouris 2013-07-21T05:41:11Z https://community.splunk.com/t5/Splunk-Search/Problem-in-Search-Command/m-p/98844#M25494 <P>Hi,</P> <P>Please take a look at my table below which i came up with using this search command </P> <P><STRONG>sourcetype="json_onemap" | stats max(cases) as NoOfCases by description location _time | sort -_time</STRONG> </P> <P>I manage to come up with this search command to see an overview of the data i want to retrieve but I just could not derive the logic. I need to sum up the no. of cases in each description with the same location in the given day. </P> <P>Please help me!</P> <P><IMG src="http://splunk-base.splunk.com//storage/qn_1.png" alt="alt text" /></P> <P>I want to achieve something like this:</P> <P><IMG src="http://splunk-base.splunk.com//storage/qn1.png" alt="alt text" /></P> <P>Thank you and have a nice day ahead !</P> Mon, 28 Sep 2020 14:22:44 GMT https://community.splunk.com/t5/Splunk-Search/Problem-in-Search-Command/m-p/98844#M25494 sbnoobbb 2020-09-28T14:22:44Z https://community.splunk.com/t5/Splunk-Search/Problem-in-Search-Command/m-p/98845#M25495 <P>do you want to achieve that at the same time that you get that table?? coz otherwise you can always omit "description" in your search, sorry not sure if I understood what you are after</P> Fri, 19 Jul 2013 02:49:53 GMT https://community.splunk.com/t5/Splunk-Search/Problem-in-Search-Command/m-p/98845#M25495 asimagu 2013-07-19T02:49:53Z https://community.splunk.com/t5/Splunk-Search/Problem-in-Search-Command/m-p/98846#M25496 <P>What I want to achieve is to add up all the cases in the same location, but I have lots of duplicate event inside splunk. The data came out incorrect when i use sum.Is okay, I have solved the problem.<BR /> Thanks anyway (:</P> Fri, 19 Jul 2013 07:58:08 GMT https://community.splunk.com/t5/Splunk-Search/Problem-in-Search-Command/m-p/98846#M25496 sbnoobbb 2013-07-19T07:58:08Z https://community.splunk.com/t5/Splunk-Search/Problem-in-Search-Command/m-p/98847#M25497 <P>Hi,</P> <P>I wouldn't use the _time field in this case. If you want a time trend a sparkline can give you a good indication of when cases happened throughout the day. How about you summarize using something like</P> <P>search.. | stats sparkline sum(cases) as NoOfCases by location</P> Sun, 21 Jul 2013 05:41:11 GMT https://community.splunk.com/t5/Splunk-Search/Problem-in-Search-Command/m-p/98847#M25497 clymbouris 2013-07-21T05:41:11Z