Need to get stats count by day

[shellnight]

I need a daily count of events of a particular type per day for an entire month

June1 - 20 events
June2 - 55 events
and so on till June 30

available fields is websitename , just need occurrences for that website for a month

[yannK]

if you want stats. not timechart. Bucket the results per day. then count per _time.

mysearch |bucket _time span=day |stats count by _time

[bcronrath]

perfect just what I was looking for thank you!

[jvarmazis_splun]

To obtain the number of daily events that matches your search criteria for the month of June 2015 per websitename, try this:

your search criteria websitename=* earliest=”6/1/2015:00:00:00” latest=”6/30/2015:23:59:59” | timechart span=1d count by websitename limit=0

By using limit=0 you will return all values (default is limit=10)

[n00badmin]

yep this would work too..my suggestion would rely in the time picker to set the time period for the search

[n00badmin]

index=%yourIndexHere% websiteName=* | timechart span=1d count by websiteName limit=0

This should work..brings back all events with "websiteName" present, then counts them per day with no limit on how any sites it will count for.

Be sure to add any further criteria to identify your events before the pipe to timechart. ( ie "LOGIN FAIL")

you could also use the bin command with stats command, but timechart does both anyhow and this gets you the visualization.

*I threw in the limit=0 in case you have a large amount of websiteNames. The default limit is 10 everything outside 10 would go to "OTHER".

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Timechart

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/CommonStatsFunctions