How to edit my search so that columns show events per date?

[mforgues]

Hi,

I am new to Splunk and I am having a hard time to achieve something I believe is basic.

I am trying to run the following search :

File Done | eval date=strftime(_time,"%Y-%m-%d") | stats count by Region, Operator, date 

and it's returning something like this :

Region  Operator    date    count
RASO    CELCOM  2017-03-23  1
RASO    CELCOM  2017-03-25  2
RASO    CELCOM  2017-03-26  1
RASO    CELCOM  2017-03-28  1
RASO    CELCOM  2017-03-29  1
RASO    DST 2017-03-28  2
RASO    DTAC    2017-03-23  1
RASO    DTAC    2017-03-24  2
RASO    DTAC    2017-03-25  2
RASO    DTAC    2017-03-26  2
RASO    DTAC    2017-03-27  1
RASO    DTAC    2017-03-28  2
RASO    DTAC    2017-03-29  2
RASO    DTN 2017-03-23  1
RASO    DTN 2017-03-24  2
RASO    DTN 2017-03-25  2
RASO    DTN 2017-03-26  2
RASO    DTN 2017-03-27  2
RASO    DTN 2017-03-28  2
RASO    DTN 2017-03-29  2

I would like to know if it's possible to have a column per date

Region  Operator 2017-03-23 2017-03-24 2017-03-25 2017-03-26 2017-03-27 2017-03-28 2017-03-29
RASO    CELCOM      1                       2           1                   1           1
RASO    DST                                                                 2           
RASO    DTAC        1           2           2           2           1       2           2
RASO    DTN     1           2           2           2           2       2           2

Sorry for the bad spacing in my examples... I hope you get the idea.

thanks.

[woodcock]

Add this to the end of your existing search:

| eval R_O = Region . "::" . Operator
| fields - Region Operator
| xyseries R_O count _time
| rex field=R_O "^(?<Region>.*)::(?<Operator>.*)$"
| fields - R_O
| table Region Operator *