Splunk Search

Stats Count by day ?

sjringo
Contributor

I have a query that gives me four totals for a month.  I am trying to figure out how to show each four total for each day searched ?

Here is what I have so far:

index=anIndex sourcetype=aSourcetype "SFTP upload finished" OR "File sent to MFS" OR "File download sent to user" OR "HTTP upload finished"
earliest=-0month@month latest=now
| bucket _time span=day
| stats count(eval(searchmatch("SFTP upload finished"))) as SFTPCount
count(eval(searchmatch("File sent to MFS"))) as MFSCount
count(eval(searchmatch("File download sent to user"))) as DWNCount
count(eval(searchmatch("HTTP upload finished"))) as HTTPCount
| table SFTPCount MFSCount DWNCount HTTPCount

SFTPCount MFSCount DWNCount HTTPCount

30843535158480

 

Now to show the results by each day ?

I have a line to specify my bucket ?

Labels (4)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Not sure if I understand the question. You already bucketed _time.  The simplest is to just use it as groupby

index=anIndex sourcetype=aSourcetype "SFTP upload finished" OR "File sent to MFS" OR "File download sent to user" OR "HTTP upload finished"
earliest=-0month@month latest=now
| bucket _time span=day
| stats count(eval(searchmatch("SFTP upload finished"))) as SFTPCount
count(eval(searchmatch("File sent to MFS"))) as MFSCount
count(eval(searchmatch("File download sent to user"))) as DWNCount
count(eval(searchmatch("HTTP upload finished"))) as HTTPCount by _time

Will this work?

View solution in original post

Tags (1)

efavreau
Motivator

@sjringo  You're so close... you need a "BY _time" on your stats line

index=anIndex sourcetype=aSourcetype "SFTP upload finished" OR "File sent to MFS" OR "File download sent to user" OR "HTTP upload finished"
earliest=-0month@month latest=now
| bucket _time span=day
| stats count(eval(searchmatch("SFTP upload finished"))) as SFTPCount
count(eval(searchmatch("File sent to MFS"))) as MFSCount
count(eval(searchmatch("File download sent to user"))) as DWNCount
count(eval(searchmatch("HTTP upload finished"))) as HTTPCount BY _time



###

If this reply helps you, an upvote would be appreciated.

yuanliu
SplunkTrust
SplunkTrust

Not sure if I understand the question. You already bucketed _time.  The simplest is to just use it as groupby

index=anIndex sourcetype=aSourcetype "SFTP upload finished" OR "File sent to MFS" OR "File download sent to user" OR "HTTP upload finished"
earliest=-0month@month latest=now
| bucket _time span=day
| stats count(eval(searchmatch("SFTP upload finished"))) as SFTPCount
count(eval(searchmatch("File sent to MFS"))) as MFSCount
count(eval(searchmatch("File download sent to user"))) as DWNCount
count(eval(searchmatch("HTTP upload finished"))) as HTTPCount by _time

Will this work?

Tags (1)

sjringo
Contributor

Yup, I was trying to do the BY _time after each count ((...)) AS ... by _time  instead of doing it after the very last one...

I knew I was close I just was not seeing it !!!

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...