Splunk Search

Getting count per day for a specific splunk query

manish41711
Engager

I run index=hydra bu=dmg env="prod-*" ERROR everyday and record the count. I lost the statistics I had kept and would like to get them back. Is there a query that can help me do this? The query should get me the count of running the above query as if run daily (24 hr span).

Tags (1)
0 Karma

DalJeanis
Legend

@manish41711 - yes, that query will get your the daily figures. So would the following

 index=hydra bu=dmg env="prod-*" ERROR
 | bin _time span=1d
 | stats count as dailycount by _time

manish41711
Engager

Will this query help ? index=hydra bu=dmg env="prod-*" ERROR earliest=-90d@d latest=@d | timechart span=1d count

niketn
Legend

@manish41711, This query gets you daily aggregated count of "ERROR" events for last 90 days. Is this what you want?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...