Splunk Search

Multiple File Indicator

zoebanning
Path Finder

Hello Splunk Community, 

I have created a query to calculate the business date of the file which arrived to be loaded & the date/time it arrived, which outputs the following (dummy data used): 

FileBusiness DateArrival DateArrival Time
File A22-11-202106-12-20216.51
File B22-11-202106-12-20216.55
File B22-11-202106-12-20216.56

 

I want to create a new column which highlights if a file (with the same business date) arrived more than once on the same day. So for example the output would look like so: 

FileBusiness DateArrival DateArrival TimeCount 
File A22-11-202106-12-20216.511
File B22-11-202106-12-20216.552
File B22-11-202106-12-20216.562

 

Can anyone help improving my query to include this new column? 

Thanks, 

Zoe

Labels (2)
0 Karma
1 Solution

manjunathmeti
Champion

hi @zoebanning,

You can use eventstats command to calculate count.

<your_existing_query> | eventstats count as Count by File, "Arrival Date"

View solution in original post

0 Karma

manjunathmeti
Champion

hi @zoebanning,

You can use eventstats command to calculate count.

<your_existing_query> | eventstats count as Count by File, "Arrival Date"
0 Karma

zoebanning
Path Finder

This worked perfectly. Thank You 🙂 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...