I'm trying to count all my data by each day of the week each time a host is hit.
EX: machine a has a script run once Monday, and Tuesday and three times on Wednesday. I just wanna track how many times a week it's hit per week. I know I can bucket _time but can't get the count function to properly display the info.
index=x sourcetype=x host=*
| bucket _time span=day
| count by host by day
Any help would be much appreciated
try use the stats
command, understand the attributes and the by
clause. and also work on your arguments of the bin
/ bucket
commands
read here:
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Bin
index=x sourcetype=x host=*
| bucket _time span=1day
| stats count by host _time
hope it helps