Splunk Search

Calculating multiple counts in one search

synastraa
Path Finder

Hi all,

I am trying to get the results for both the stats count in the code below.

I'm getting no results when I do both counts together in the search but when I do them individually, the results shows up. Could I get some advice on this if I am doing anything wrong here. Thanks!

eval reported=strftime(strptime(Reported_Date_Time,"%Y-%m-%d%H:%M:%S.%Q"),"%b")|eval resolved=strftime(strptime(Last_Resolved_Date_Time,"%Y-%m-%d%H:%M:%S.%Q"),"%b-%Y")
|stats count(Incident_Number) as inflow by reported | stats count(Incident_Number) as close by resolved
Tags (1)
0 Karma

woodcock
Esteemed Legend

Try this:

.... | eval reported=strftime(strptime(Reported_Date_Time,"%Y-%m-%d%H:%M:%S.%Q"),"%b")
| eval resolved=strftime(strptime(Last_Resolved_Date_Time,"%Y-%m-%d%H:%M:%S.%Q"),"%b-%Y")
| eval _time = coalesce(reported, resolved)
| eval Incident_Number = if(isnotnull(Incident_Number), _time, null())
| timechart count(Incident_Number) by Incident_Number
0 Karma

synastraa
Path Finder

Hi,

The results I'm looking for are as shown. Thanks!

_time Inflow closed (Inflow - closed) ( accumulated (inflow - closed ) )
Jan 10 | 5 | 5 | 5
Feb 10 | 5 | 5 | 10
Mar 20 | 7 | 13 | 23

0 Karma

woodcock
Esteemed Legend

OK, now show us the raw events that would generate this result.

0 Karma

woodcock
Esteemed Legend

Like this:

.... | eval reported=strftime(strptime(Reported_Date_Time,"%Y-%m-%d%H:%M:%S.%Q"),"%b")
| eval resolved=strftime(strptime(Last_Resolved_Date_Time,"%Y-%m-%d%H:%M:%S.%Q"),"%b-%Y")
| multireport
[ stats count(Incident_Number) as inflow by reported ]
[ stats count(Incident_Number) as close by resolved ]
0 Karma

synastraa
Path Finder

I have tried this out and only the first stats count results was displayed.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...