Splunk Search

Count Issues

garrettpelak5
New Member

I'm trying to count all my data by each day of the week each time a host is hit.
EX: machine a has a script run once Monday, and Tuesday and three times on Wednesday. I just wanna track how many times a week it's hit per week. I know I can bucket _time but can't get the count function to properly display the info.

index=x sourcetype=x host=*
| bucket _time span=day
| count by host by day

Any help would be much appreciated

0 Karma

adonio
Ultra Champion

try use the stats command, understand the attributes and the by clause. and also work on your arguments of the bin / bucket commands
read here:
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Bin

index=x sourcetype=x host=*
| bucket _time span=1day
| stats count by host _time

hope it helps

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...