Count Issues

[garrettpelak5]

I'm trying to count all my data by each day of the week each time a host is hit.
EX: machine a has a script run once Monday, and Tuesday and three times on Wednesday. I just wanna track how many times a week it's hit per week. I know I can bucket _time but can't get the count function to properly display the info.

index=x sourcetype=x host=*
| bucket _time span=day
| count by host by day

Any help would be much appreciated

[adonio]

try use the stats command, understand the attributes and the by clause. and also work on your arguments of the bin / bucket commands
read here:
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Bin

index=x sourcetype=x host=*
| bucket _time span=1day
| stats count by host _time

hope it helps