topic time vs repeating data in Splunk Search

time vs repeating data

jdomar — Fri, 01 Nov 2013 14:37:59 GMT

I would like to set a search timeframe of 1 week and for each day report the subtotals of Items 1, 2 and 3 (the items are the same for each day but the Quantity changes). The output would reflect this as:

2013-11-01.....Item 1.....Quantity

2013-11-01.....Item 2.....Quantity

2013-11-01.....Item 3.....Quantity

2013-11-02.....Item 1.....Quantity

2013-11-02.....Item 2.....Quantity

2013-11-02.....Item 3.....Quantity

2013-11-03.....Item 1.....Quantity

2013-11-03.....Item 2.....Quantity

2013-11-03.....Item 3.....Quantity

etc.
I am able to isolate all of the field data but i am not sure how to structure the search to give the above output.

Any help would be greatly appreciated.

Re: time vs repeating data

kristian_kolb — Fri, 01 Nov 2013 14:46:08 GMT

Hi,

...| bucket _time span=1d | stats sum(Quantity) by Item, _time

Is probably close to what you need, but there are other options, depending on what your data looks like. Other options include;

... | timechart span=1d sum(Quantity) by Item

Hope this helps,

Re: time vs repeating data

Akita881 — Fri, 01 Nov 2013 15:00:04 GMT

That work with tweaking. Thank you, Very much!