Splunk Search

Problem in Search Command

sbnoobbb
Path Finder

Hi,

Please take a look at my table below which i came up with using this search command

sourcetype="json_onemap" | stats max(cases) as NoOfCases by description location _time | sort -_time

I manage to come up with this search command to see an overview of the data i want to retrieve but I just could not derive the logic. I need to sum up the no. of cases in each description with the same location in the given day.

Please help me!

alt text

I want to achieve something like this:

alt text

Thank you and have a nice day ahead !

Tags (2)

clymbouris
Path Finder

Hi,

I wouldn't use the _time field in this case. If you want a time trend a sparkline can give you a good indication of when cases happened throughout the day. How about you summarize using something like

search.. | stats sparkline sum(cases) as NoOfCases by location

0 Karma

sbnoobbb
Path Finder

What I want to achieve is to add up all the cases in the same location, but I have lots of duplicate event inside splunk. The data came out incorrect when i use sum.Is okay, I have solved the problem.
Thanks anyway (:

0 Karma

asimagu
Builder

do you want to achieve that at the same time that you get that table?? coz otherwise you can always omit "description" in your search, sorry not sure if I understood what you are after

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...