Splunk Search

Count Issues

New Member

I'm trying to count all my data by each day of the week each time a host is hit.
EX: machine a has a script run once Monday, and Tuesday and three times on Wednesday. I just wanna track how many times a week it's hit per week. I know I can bucket _time but can't get the count function to properly display the info.

index=x sourcetype=x host=*
| bucket _time span=day
| count by host by day

Any help would be much appreciated

0 Karma


try use the stats command, understand the attributes and the by clause. and also work on your arguments of the bin / bucket commands
read here:

index=x sourcetype=x host=*
| bucket _time span=1day
| stats count by host _time

hope it helps

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!