How to retrieve time\date after distinct count search?

[abovebeyond]

Hi,

My search is:

mysearch |  stats dc(Errorcode) as Errors By Name

I want to get results for 2 options:

option 1: adding date to the results
option 2 : distinct count by date , Errorcode , Name

Thanks 🙂

[esix_splunk · Accepted solution]

You can update your search as

mysearch | stats dc(Errorcode) as Errors By Name _time 

That will add the _time field to your results. You may want to consider bucketing your time into larger groups here however. For example if you have 10 events that occur every 1 minute, your DC will now by off because its grouping by time also. So you might want to do..

mysearch | bin span=1d _time | stats dc(Errorcode) as Errors By Name _time

This will group the results together in 1 day buckets. So you'll look at a DC of Errorcode over a 24h period.

It's also worth noting that stats is a reducing command. If you are wanting to maintain the time stamp of the original events, you'll need to do some additional work along the lines of creating a new field that holds the timestamp of the event and adding that into the stats pipeline.

[abovebeyond]

Thanks ! exactly what i need

appreciate your help

[ppablo]

Hi @abovebeyond

Glad you were able to find a solution from @esix_splunk here on Answers. Don't forget to resolve your posts by clicking "Accept" directly below the answers that solved your questions to help other users with similar issues find them.