Splunk Search

How can I write a seach to get count of each application per day?

knarayana
New Member

I am looking for a search to get a count of each application per day. Below is the search I have now, which gives count for everything for that day. I need count per application per day.

index=index1 ...| bin span=1d _time | stats values(app) count(app) by _time

The result I get is below:

08/10/17    app1, app2, app3      total count of all 3 apps.

But what I want is this:

08/10/17         app1     count of app1
                 app2     count of app2
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Try this ...

 index=index1 ...| bin span=1d _time | stats count as appcount by _time app.

woodcock
Esteemed Legend

It is the count(app) thing that gets everybody. What we all should understand (and what is not taught anywhere) is that count(app) is actually count(eval(isnotnull(app))) which in the vast majority if cases simplifies down to being just count.

DalJeanis
SplunkTrust
SplunkTrust

Yeah, I avoid () with count whenever I can, especially when typing aircode. Figuring out what quotes are needed for evals in there is nontrivial at the moment. Write many, test many, post... well, usually twice...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...