Splunk Search
Highlighted

Need to get stats count by day

Explorer

I need a daily count of events of a particular type per day for an entire month

June1 - 20 events
June2 - 55 events
and so on till June 30

available fields is websitename , just need occurrences for that website for a month

Tags (3)
0 Karma
Highlighted

Re: Need to get stats count by day

Communicator

index=%yourIndexHere% websiteName=* | timechart span=1d count by websiteName limit=0

This should work..brings back all events with "websiteName" present, then counts them per day with no limit on how any sites it will count for.

Be sure to add any further criteria to identify your events before the pipe to timechart. ( ie "LOGIN FAIL")

you could also use the bin command with stats command, but timechart does both anyhow and this gets you the visualization.

*I threw in the limit=0 in case you have a large amount of websiteNames. The default limit is 10 everything outside 10 would go to "OTHER".

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Timechart

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/CommonStatsFunctions

Highlighted

Re: Need to get stats count by day

Splunk Employee
Splunk Employee

To obtain the number of daily events that matches your search criteria for the month of June 2015 per websitename, try this:

your search criteria websitename=* earliest=”6/1/2015:00:00:00” latest=”6/30/2015:23:59:59” | timechart span=1d count by websitename limit=0

By using limit=0 you will return all values (default is limit=10)

0 Karma
Highlighted

Re: Need to get stats count by day

Communicator

yep this would work too..my suggestion would rely in the time picker to set the time period for the search

0 Karma
Highlighted

Re: Need to get stats count by day

Splunk Employee
Splunk Employee

if you want stats. not timechart. Bucket the results per day. then count per _time.

mysearch |bucket _time span=day |stats count by _time

Highlighted

Re: Need to get stats count by day

Path Finder

perfect just what I was looking for thank you!

0 Karma