Splunk Search

Splunk search for each month

Path Finder

HI All,

Need help in preparing a tabular form.

Data am having : 

using the Index am getting below table.

ClassCount
NODEDOWN520
BGPDOWN320
ISISALERT130

 

Query am using

 

index=itsm
stats count by Class

 

Last 60 days data.

 

Requirement: 

I want month wise data. I used timewrap and timechart.  But the data am getting is not the correct format.

 

Expected format output.

ClassJul-20Aug-20Sep-20
NODEDOWN25025020
BGPDOWN15015020
ISISALERT505030

 

Please help me this format, 

If it search for 1 year data. all 12 months in tabular data.

Labels (5)
0 Karma
1 Solution

Super Champion

 

index=itsm
| bin span=1mon _time
| eval month_Year = strftime(_time,"%b-%y")
| chart count over Class by month_Year

 

————————————
If this helps, give a like below.

View solution in original post

0 Karma

Super Champion

 

index=itsm
| bin span=1mon _time
| eval month_Year = strftime(_time,"%b-%y")
| chart count over Class by month_Year

 

————————————
If this helps, give a like below.

View solution in original post

0 Karma

Path Finder

HI, 

My order is coming as below. how can i make it on order.

I tried above qury and that provides me output, but all the order is in alphabetical order not in the month wise order. its not useful data. Please help me get it in month wise order

ClassAug-20Jul-20Sep-20
NODEDOWN20020020
Tags (1)
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!