Splunk Search

How to add host to command in the BY section?

AShwin1119
Explorer

| chart values(Date_Policy) BY Volume,WeekRange,


in above command I wanted to add host as well in the BY section but not getting result for it. Can any help to fix this.


| chart values(Date_Policy) BY Volume,WeekRange, host

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AShwin1119,

did you explored the values option in stats command?

| stats values(Date_Policy) AS Date_Policy values(host) AS host BY Volume WeekRange

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...