Splunk Search

How to do stats count for different day?

rick1168
Engager

| stats count by field1 field1 field2 field3 only show yesterday count,  how can I  show count1 for yesterday, count2 for 2-day ago, count3 for 3-day ago,

shown as following

field1   field2 field3 count1 count2 coun3

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1d
| stats count by _time field1 field2 field3
| eventstats values(_time) as dates
| eval day=mvfind(dates, _time)+1
| eval count{day} = count
| fields - count dates day _time
| stats values(*) as * by field1 field2 field3

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1d
| stats count by _time field1 field2 field3
| eventstats values(_time) as dates
| eval day=mvfind(dates, _time)+1
| eval count{day} = count
| fields - count dates day _time
| stats values(*) as * by field1 field2 field3
0 Karma

rick1168
Engager

它有效. thanks

0 Karma

bowesmana
SplunkTrust
SplunkTrust
your search
| bin _time span=1d
| stats count by _time field1 field2 field3

also you will need your time range window to cover the time range you are interested in

The timechart  command may also be useful

0 Karma

rick1168
Engager

Could timechart multiple fields and time window in column?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

No timechart is only a single split field, but I mentioned it in case it was relevant.

The stats command with _time and the bin command should do the trick for you.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...