Splunk Search

How to edit my search to find the total count value per month per user?

galtertime
New Member

I am trying to count the total report runs per month per user.

Example:

"SEARCH STRING" |fields cs_username cs_uri_stem  | eval Month=strftime(_time,"%b") | stats values(Month),count(cs_uri_stem) by cs_username

The results appears in a table like:
USERNAME---Apr -----60---
----------------- Feb -----------
------------------Mar------------

The results are grouped by username, and month, but the count value is total for all months. I need the count value per month. Please assist.

Tags (4)
0 Karma

javiergn
Super Champion

Try this instead:

"SEARCH STRING" 
| fields _time cs_username cs_uri_stem 
| eval Month=strftime(_time,"%b") 
| stats count(cs_uri_stem) by cs_username, Month

---- Edit to include this other option ---

"SEARCH STRING" 
 | fields _time cs_username cs_uri_stem 
 | eval Month=strftime(_time,"%b") 
 | stats count(cs_uri_stem) as count by cs_username, Month
 | stats list(Month) as Month, list(count) as count by cs_username
0 Karma

galtertime
New Member

your example produces an output that removes the desired grouping. I want the grouping of months shown in my example above, but the count broken down by month. The example you gave Lists the username and count per month on separate rows.

0 Karma

javiergn
Super Champion

Hi, still not clear to me what you are trying to achieve. If you could paste your desired output using the Code Format button (the one above with 1s and 0s) it would be very helpful.

Anyway, try this other approach and let me know if that helps:

"SEARCH STRING" 
| fields _time cs_username cs_uri_stem 
| eval Month=strftime(_time,"%b") 
| stats count(cs_uri_stem) as count by cs_username, Month
| stats list(Month) as Month, list(count) as count by cs_username
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...