Splunk Search

How to add host to command in the BY section?

AShwin1119
Explorer

| chart values(Date_Policy) BY Volume,WeekRange,


in above command I wanted to add host as well in the BY section but not getting result for it. Can any help to fix this.


| chart values(Date_Policy) BY Volume,WeekRange, host

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AShwin1119,

did you explored the values option in stats command?

| stats values(Date_Policy) AS Date_Policy values(host) AS host BY Volume WeekRange

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...