Getting Data In

How can I add an previous date count information column?

hoya
New Member

I'd like to see the previous date count together with the current date count on one line. Is there a way?

The present condition is as follows:

=> spl : | stats count("bug_id") as count by date

date count

2019-01-31 100

2019-01-29 75

2019-01-21 50

The examples I want are as follows.
( add column : pre_date_count)


date count pre_date_count

2019-01-31 100 75
2019-01-29 75 50
2019-01-21 50

Thank you for your interest.

0 Karma

renjith_nair
Legend

@hoya,
Try

=> spl : | stats count("bug_id") as count by date
|reverse|streamstats current=f window=1 last(count) as pre_date_count |reverse
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...