Splunk Search

How to use eval to group dates?

viandyg
Engager

I have 4 columns of data:

Country    City    Date    Price

I want to make a table where the Price column is is summed for each day for a particular City

Example raw data:

Country    City    Date    Price
a1          b1      2019-01-01    5
a1          b2      2019-01-01    3
a2          c1      2019-01-02    4
a2          c1      2019-01-02    7
a2          c2      2019-01-02    2

Desired Output (only the Price in city c1 is summed because it has 2 entries on the same date):

Country    City    Date    Price
a1          b1      2019-01-01    5
a1          b2      2019-01-01    3
a2          c1      2019-01-02    11
a2          c2      2019-01-02    2

I have tried using eventstats sum(Price) as newPrice by Date but it gives weird number for the new column.

I would appreciate any and all help! Please and thank you!

Tags (1)
0 Karma
1 Solution

nareshinsvu
Builder
| stats values(Country) as Country   sum(Price) as Price  by Date  City

View solution in original post

nareshinsvu
Builder
| stats values(Country) as Country   sum(Price) as Price  by Date  City
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...