Splunk Search

I have an event contains join_date, id as fields , want to count of "id " by month ,

nagarjuna280
Communicator

I have an event contains join_date, id as fields , want to count of "id " by month ,

the event index time and start_date are different. all events are indexed at a time

I tried

|eval _time=strftime(strptime(join_date,"%d-%b-%y %H:%M:%S"), "%Y-%m-%d %H:%M:%S") |timechart span=1d count(id)

not showing results

Tags (1)
0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

You could try something like this:

YOUR BASE SEARCH
| eval joinmonth=strftime(strptime(join_date,"%m/%d/%Y"),"%B") 
| stats count(id) by joinmonth

View solution in original post

kmorris_splunk
Splunk Employee
Splunk Employee

You could try something like this:

YOUR BASE SEARCH
| eval joinmonth=strftime(strptime(join_date,"%m/%d/%Y"),"%B") 
| stats count(id) by joinmonth

adonio
Ultra Champion

hello nagarjuna280,
can you elaborate a little, or attach a sample data?
it is not clear as you mention the event contains join_date and in the second sentence you mention start_date
in any case, if you want the count of id by month, use span of 1mon
also, maybe you can extract the time while on boarding the data

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...