Splunk Search

How to edit my search to find the total count value per month per user?

galtertime
New Member

I am trying to count the total report runs per month per user.

Example:

"SEARCH STRING" |fields cs_username cs_uri_stem  | eval Month=strftime(_time,"%b") | stats values(Month),count(cs_uri_stem) by cs_username

The results appears in a table like:
USERNAME---Apr -----60---
----------------- Feb -----------
------------------Mar------------

The results are grouped by username, and month, but the count value is total for all months. I need the count value per month. Please assist.

Tags (4)
0 Karma

javiergn
Super Champion

Try this instead:

"SEARCH STRING" 
| fields _time cs_username cs_uri_stem 
| eval Month=strftime(_time,"%b") 
| stats count(cs_uri_stem) by cs_username, Month

---- Edit to include this other option ---

"SEARCH STRING" 
 | fields _time cs_username cs_uri_stem 
 | eval Month=strftime(_time,"%b") 
 | stats count(cs_uri_stem) as count by cs_username, Month
 | stats list(Month) as Month, list(count) as count by cs_username
0 Karma

galtertime
New Member

your example produces an output that removes the desired grouping. I want the grouping of months shown in my example above, but the count broken down by month. The example you gave Lists the username and count per month on separate rows.

0 Karma

javiergn
Super Champion

Hi, still not clear to me what you are trying to achieve. If you could paste your desired output using the Code Format button (the one above with 1s and 0s) it would be very helpful.

Anyway, try this other approach and let me know if that helps:

"SEARCH STRING" 
| fields _time cs_username cs_uri_stem 
| eval Month=strftime(_time,"%b") 
| stats count(cs_uri_stem) as count by cs_username, Month
| stats list(Month) as Month, list(count) as count by cs_username
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...