How to add host to command in the BY section? - Splunk Community

Splunk Search

| chart values(Date_Policy) BY Volume,WeekRange,

in above command I wanted to add host as well in the BY section but not getting result for it. Can any help to fix this.

| chart values(Date_Policy) BY Volume,WeekRange, host

Hi @AShwin1119,

did you explored the values option in stats command?

| stats values(Date_Policy) AS Date_Policy values(host) AS host BY Volume WeekRange

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...