How to do stats count for different day?

[rick1168]

| stats count by field1 field1 field2 field3 only show yesterday count,  how can I  show count1 for yesterday, count2 for 2-day ago, count3 for 3-day ago,

shown as following

field1   field2 field3 count1 count2 coun3

[ITWhisperer · Accepted solution]

| bin _time span=1d
| stats count by _time field1 field2 field3
| eventstats values(_time) as dates
| eval day=mvfind(dates, _time)+1
| eval count{day} = count
| fields - count dates day _time
| stats values(*) as * by field1 field2 field3

[rick1168]

它有效. thanks

[bowesmana]

your search
| bin _time span=1d
| stats count by _time field1 field2 field3

also you will need your time range window to cover the time range you are interested in

The timechart  command may also be useful

[rick1168]

Could timechart multiple fields and time window in column?

[bowesmana]

No timechart is only a single split field, but I mentioned it in case it was relevant.

The stats command with _time and the bin command should do the trick for you.