Splunk Search

How to group by two months.

tabishritz
Observer

My query

"mwt-service"  my query |stats count by channel service date_month

yields result like

channelservicemonthcount
PBXFNTFnovember4
STEACTRnovember5
PBXFNTFoctober6
STEACTRoctober9

 

But I want to have two columns of each month count as below

channelservicenovoct
PBXFNTF45
STEACTR38

 

please advice.
 
 
Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval nov=if(month="november",count,null)
| eval oct=if(month="october",count,null)
| fields - month count
| stats values(*) as * by channel, service
0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...