Splunk Search

How to add host to command in the BY section?

AShwin1119
Explorer

| chart values(Date_Policy) BY Volume,WeekRange,


in above command I wanted to add host as well in the BY section but not getting result for it. Can any help to fix this.


| chart values(Date_Policy) BY Volume,WeekRange, host

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AShwin1119,

did you explored the values option in stats command?

| stats values(Date_Policy) AS Date_Policy values(host) AS host BY Volume WeekRange

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

[Puzzles] Solve, Learn, Repeat: Nested loops in Event Conversion

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...