Please take a look at my table below which i came up with using this search command
sourcetype="json_onemap" | stats max(cases) as NoOfCases by description location _time | sort -_time
I manage to come up with this search command to see an overview of the data i want to retrieve but I just could not derive the logic. I need to sum up the no. of cases in each description with the same location in the given day.
Please help me!
I want to achieve something like this:
Thank you and have a nice day ahead !
I wouldn't use the _time field in this case. If you want a time trend a sparkline can give you a good indication of when cases happened throughout the day. How about you summarize using something like
search.. | stats sparkline sum(cases) as NoOfCases by location
What I want to achieve is to add up all the cases in the same location, but I have lots of duplicate event inside splunk. The data came out incorrect when i use sum.Is okay, I have solved the problem.
Thanks anyway (: