https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223234#M65713 <P>You are welcome, Please mark as answer so that the thread will be closed</P> Tue, 12 Jan 2016 10:48:42 GMT renjith_nair 2016-01-12T10:48:42Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223226#M65705 <P>This is my expected result:</P> <PRE><CODE>Exceptions Day1 Day2 Day3 Day4 Day5 Abc 5 4 3 1 0 Start 3 4 4 5 6 xyz 3 2 5 0 0 </CODE></PRE> Tue, 12 Jan 2016 10:02:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223226#M65705 Madhan45 2016-01-12T10:02:18Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223227#M65706 <P>Try this</P> <PRE><CODE>your search |chart count over Exceptions by &lt;day field&gt; </CODE></PRE> <P>or if you don't have a day field</P> <PRE><CODE> your search |chart span=1d count over Exceptions by _time </CODE></PRE> Tue, 12 Jan 2016 10:07:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223227#M65706 renjith_nair 2016-01-12T10:07:43Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223228#M65707 <P>It shows results only for first exception.!!</P> Tue, 12 Jan 2016 10:15:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223228#M65707 Madhan45 2016-01-12T10:15:41Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223229#M65708 <P>Do you have other Exceptions in the events? Just try this to see how it works </P> <PRE><CODE> index=* earliest=-7d|chart count over sourcetype by _time span=1d </CODE></PRE> Tue, 12 Jan 2016 10:21:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223229#M65708 renjith_nair 2016-01-12T10:21:07Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223230#M65709 <P>great working fine. But now the problem is dates are in epoch format. How to convert that in to normal format?</P> Tue, 12 Jan 2016 10:29:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223230#M65709 Madhan45 2016-01-12T10:29:13Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223231#M65710 <P>Just convert time before chart ie </P> <PRE><CODE> index=* earliest=-7d|eval _time=strftime(_time,"%d-%m-%Y")|chart count over sourcetype by _time span=1d </CODE></PRE> <P>You can use other variables instead of _time as well.</P> <P>If you got the answer, just mark as answer so that the thread will be closed</P> Tue, 12 Jan 2016 10:42:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223231#M65710 renjith_nair 2016-01-12T10:42:57Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223232#M65711 <P>Found Now it is working fine.<BR /> index=_internal sourcetype=* earliest=-7d | eval time=strftime(_time,"%m/%d/%y") |chart count over sourcetype by time span=1d </P> Tue, 29 Sep 2020 08:21:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223232#M65711 Madhan45 2020-09-29T08:21:57Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223233#M65712 <P>Thank you renjith</P> Tue, 12 Jan 2016 10:43:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223233#M65712 Madhan45 2016-01-12T10:43:59Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223234#M65713 <P>You are welcome, Please mark as answer so that the thread will be closed</P> Tue, 12 Jan 2016 10:48:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-Exceptions-for-last-5-days-in-a-single/m-p/223234#M65713 renjith_nair 2016-01-12T10:48:42Z