topic Display day wise results for a stats count in Splunk Search

Display day wise results for a stats count

maria2691 — Fri, 12 Jan 2018 11:39:08 GMT

Hello

I have a below query.
sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table RunID, Robot, host, duration

I need to count the sum(duration) by host and I want the result to be displayed day wise.

The result should be something like, Day1, host1, duration
Day1, host2, duration
Day2, host1, duration
Day2, host2, duration

How can I do that? Timechard sum(duration) span=1d works, but I need the duration to be calculated according to the host. How do I do that?

Thanks
Maria Arokiaraj

Re: Display day wise results for a stats count

mayurr98 — Fri, 12 Jan 2018 11:48:02 GMT

hey try this

sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | table _time RunID, Robot, host, duration | bin _time span=1d  | stats sum(duration) by _time host | sort- _time

let me know if this helps!

Re: Display day wise results for a stats count

maria2691 — Fri, 12 Jan 2018 12:25:22 GMT

Hello @mayurr98

I tried this one already with bucket command and now with bin also as you have suggested.
For some reason, I am not getting any results out of these queries 😞

Re: Display day wise results for a stats count

mayurr98 — Fri, 12 Jan 2018 12:31:25 GMT

hey can you try this as | table _time RunID, Robot, host, duration seems irrelavent. Also try below query for last 7 days or more. I tried in a test environment the query is working as long as you have enough data.Specify your_index at start of the search

 index=your_index  sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID | bin _time span=1d  | stats sum(duration) by _time host | sort- _time

If above query does not work then try sourcetype=ProcessStart OR sourcetype=ProcessEnd | transaction RunID and see if you get any output. If you are getting output then the above query must work.

Re: Display day wise results for a stats count

maria2691 — Fri, 12 Jan 2018 13:29:20 GMT

Thanks @mayurr98

It worked. Understood that the Table command in between caused the issue 🙂