Splunk Search

Problem in Search Command

Path Finder

Hi,

Please take a look at my table below which i came up with using this search command

sourcetype="jsononemap" | stats max(cases) as NoOfCases by description location _time | sort -time

I manage to come up with this search command to see an overview of the data i want to retrieve but I just could not derive the logic. I need to sum up the no. of cases in each description with the same location in the given day.

Please help me!

alt text

I want to achieve something like this:

alt text

Thank you and have a nice day ahead !

Tags (2)

Path Finder

Hi,

I wouldn't use the _time field in this case. If you want a time trend a sparkline can give you a good indication of when cases happened throughout the day. How about you summarize using something like

search.. | stats sparkline sum(cases) as NoOfCases by location

0 Karma

Path Finder

What I want to achieve is to add up all the cases in the same location, but I have lots of duplicate event inside splunk. The data came out incorrect when i use sum.Is okay, I have solved the problem.
Thanks anyway (:

0 Karma

Builder

do you want to achieve that at the same time that you get that table?? coz otherwise you can always omit "description" in your search, sorry not sure if I understood what you are after

0 Karma