Splunk Search

How to separate data into groups of how often they appear?

msage
Path Finder

Looking to create a chart that can separate results into groups of how often they appear in a time range. 

We're looking to figure out attendance in our office and find out which employees are showing up 1, 2, 3 times per week to get a better understanding. Is this something that can be done?

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

| bin _time span=1w
| stats count as attendance by _time employee
| stats count as frequency by _time attendance
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...