Hello,
I have a search that calculates the total number of a specific log event and displays results in the table format below:
col1 col2 col3 col4
23 25 26 27
How do I display the results by day? for example:
_time col1 col2 col3
2018-05-03 270 23 35
2018-05-04 814 33 25
Total xxxx 56 60
Thanks,
Just add an appropriately placed | bin span=1d _time
and then add _time
to the BY
clause of your stats
command.
You'd get a better answer if you could share your current search. Depending upon you current search (how you calculated values for those columns) you'd use timechart or bin-stats or bin-chart combination.
The Timechart command (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip) or the bin command. Either of those commands would do what your looking for. I would start with the timechart command and expand from there.