How to search the count of a field with multiple values by day?

[jjc42]

Hi,

I'm new to Splunk, so please bear with me. I'm trying to get a count of a field with multiple values by day. As an example, the field is Product_Name. Product_Name can have values such as "iPhone", "iPad", "MacBook" and so on. The number of values is in the hundreds (possibly thousands). I'd like a count of Product_Name by day (for the last 30 days) that I can then export to Excel. The following seemed to get me the closest:

Product_Name="*" | timechart count by Product_Name

This doesn't group the results by day (I tried bucket _time span=1d, but it didn't seem to work). It also doesn't include the full list of values (only about a dozen) and the export option is not available.

The following provides the full list with count, but is not by day:

Product_Name="*" | top limit=10000 Product_Name

Thanks very much for the help!

[ngatchasandra]

Hi jjc42,

If i understand your problem, try with this:

 Product_Name="*"| timechart span=1d  count by Product_Name  |mvexpand  Product_Name

[jjc42]

Thanks for your reply. I gave it a try, but I'm not quite sure what "mvexpand" is supposed to do. The results look similar to what I had originally.

[sideview · Accepted solution]

You were really close.

Product_Name="*" | timechart span=1d count by Product_Name

If you have more than 10 product names, after those 10 it'll roll the rest up in an "OTHER" column which you might not want. To remove that "OTHER" column you want this.

Product_Name="*" | timechart span=1d count by Product_Name limit=100

Which technically doesn't remove the possibility of OTHER, it just raises the threshold from 10 to 100.

If you can make the time, it may be worth spending some time with the search manual
http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Whatsinthismanual

or if it's more your style, the Search Tutorial. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchTutorial/WelcometotheSearchTutorial

[jjc42]

That works. Thanks! And thanks for the links. I'll take a look.