topic Re: Use of Count by Date in |metadata type=hosts in Splunk Search

Use of Count by Date in |metadata type=hosts

hcheang — Tue, 09 Dec 2014 18:14:37 GMT

Hello. I would like to know if there is any speicific - convenient - way to perform stats count by various date.

Using |metadata type=hosts |fields host totalCount, I get something like this

host               totalCount
    A                    5
    B                    27
    C                    48
    D                    95

I would like to perform stats count by name over a period of time by date

but the problem is that the log does not come with the timestamp.

Is this the only way or is there any easier way to run the query to collect all the counts for date to get something like this;

  host      12/04/14      12/05/14      12/06/14      ...
    A         5           10              ...
    B         27          12              ...
    C         48          40              ...
    D         95          25              ...

Thanks in advance!

Re: Use of Count by Date in |metadata type=hosts

richgalloway — Tue, 09 Dec 2014 18:37:54 GMT

All events have the _time field automatically added by Splunk. You can use that to generate your reports.

Re: Use of Count by Date in |metadata type=hosts

hcheang — Tue, 09 Dec 2014 18:52:58 GMT

It's in metadata format in fact.

|metadata type=hosts

And no, I 've tried |metadata type=hosts|stats count by _time

and it gives nothing.

Re: Use of Count by Date in |metadata type=hosts

somesoni2 — Tue, 09 Dec 2014 22:15:48 GMT

The metadata command doesn't contains the time field for when the report was generated. Try this workaround:-

| metasearch index=* | eval Date=strftime(_time,"%Y-%m-%d") | chart count over host by Date

Re: Use of Count by Date in |metadata type=hosts

hcheang — Thu, 11 Dec 2014 17:21:05 GMT

The chart it is generating is exactly what I want but the problem is that it is giving the wrong count.

Moreover, after 2 days count (as of Today, 2014-12-10, 2014-12-11), all I'm getting is 0 for the count which isn't true.

Any suggestion?