Hi,
My initial Splunk query was:
index="ABC" sourcetype="DEF"
| stats dc(fruit) AS "Fruits" by Diet
| sort -"Fruits"
However, I need to add a new field "Fruits 7 days ago" which finds the distinct count of "fruit" by "Diet". My current query is as follows:
index="ABC" sourcetype="DEF"
| stats dc(fruit) AS "Fruits" by Diet
|append [search earliest=-1w@w latest=@w
index="ABC" sourcetype="DEF"
| stats dc(fruit) AS "Fruits 7 days ago" by Diet ]
| sort -"Fruits", "Fruits 7 days ago"
Can you please help as I should be getting 3 outputted fields: "Diet", "Fruits", "Fruits 7 days ago" BUT I am still only getting "Diet" and "Fruits".
Can you please help?
Many thanks!
