Getting count per day for a specific splunk query

manish41711 · ‎10-05-2017

I run index=hydra bu=dmg env="prod-*" ERROR everyday and record the count. I lost the statistics I had kept and would like to get them back. Is there a query that can help me do this? The query should get me the count of running the above query as if run daily (24 hr span).

DalJeanis · ‎10-05-2017

@manish41711 - yes, that query will get your the daily figures. So would the following

 index=hydra bu=dmg env="prod-*" ERROR
 | bin _time span=1d
 | stats count as dailycount by _time

manish41711 · ‎10-05-2017

Will this query help ? index=hydra bu=dmg env="prod-*" ERROR earliest=-90d@d latest=@d | timechart span=1d count

niketn · ‎10-05-2017

@manish41711, This query gets you daily aggregated count of "ERROR" events for last 90 days. Is this what you want?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Getting count per day for a specific splunk query

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Almost Too Eventful Assurance: Part 1

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Are you a member of the Splunk Community?

Getting count per day for a specific splunk query

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Almost Too Eventful Assurance: Part 1

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1