Splunk Search

Multiple File Indicator

zoebanning
Path Finder

Hello Splunk Community, 

I have created a query to calculate the business date of the file which arrived to be loaded & the date/time it arrived, which outputs the following (dummy data used): 

FileBusiness DateArrival DateArrival Time
File A22-11-202106-12-20216.51
File B22-11-202106-12-20216.55
File B22-11-202106-12-20216.56

 

I want to create a new column which highlights if a file (with the same business date) arrived more than once on the same day. So for example the output would look like so: 

FileBusiness DateArrival DateArrival TimeCount 
File A22-11-202106-12-20216.511
File B22-11-202106-12-20216.552
File B22-11-202106-12-20216.562

 

Can anyone help improving my query to include this new column? 

Thanks, 

Zoe

Labels (2)
0 Karma
1 Solution

manjunathmeti
Champion

hi @zoebanning,

You can use eventstats command to calculate count.

<your_existing_query> | eventstats count as Count by File, "Arrival Date"

View solution in original post

0 Karma

manjunathmeti
Champion

hi @zoebanning,

You can use eventstats command to calculate count.

<your_existing_query> | eventstats count as Count by File, "Arrival Date"
0 Karma

zoebanning
Path Finder

This worked perfectly. Thank You 🙂 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...