Splunk Search

Multiple stats command

lkslsaks
Loves-to-Learn

 

bin _time span=1h | stats count(eval(eventDay==curDay)) AS cv by uid | stats count(eval(eventDay!=curDay)) AS ce by _time, uid 

 

The following commands returns with null value in  "cv"  @Lowell @Hazel  @ramdaspr @ITWhisperer

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is this what you are trying to do - if not, please explain what you are attempting to do (not just what doesn't work)

bin _time span=1h | stats count(eval(eventDay==curDay)) AS cv count(eval(eventDay!=curDay)) AS ce by _time, uid 
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@lkslsaks 

Your second stats will not work. Because after 1st stats there will be only cv and uid fields available in results.

bin _time span=1h | stats count(eval(eventDay==curDay)) AS cv by uid 

 

The second stats required  eventDay,curDay,_time and uid. That's Y you are not getting any results.

| stats count(eval(eventDay!=curDay)) AS ce by _time, uid

 

Please share the logic or steps for your search. So we can help you on.

KV

0 Karma
Get Updates on the Splunk Community!

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Automatic Discovery Part 2: Setup and Best Practices

In Part 1 of this series, we covered what Automatic Discovery is and why it’s critical for observability at ...