Splunk Search

How to group by two months.

tabishritz
Observer

My query

"mwt-service"  my query |stats count by channel service date_month

yields result like

channelservicemonthcount
PBXFNTFnovember4
STEACTRnovember5
PBXFNTFoctober6
STEACTRoctober9

 

But I want to have two columns of each month count as below

channelservicenovoct
PBXFNTF45
STEACTR38

 

please advice.
 
 
Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval nov=if(month="november",count,null)
| eval oct=if(month="october",count,null)
| fields - month count
| stats values(*) as * by channel, service
0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...