Splunk Search

count events by day when stats has multiple BY clause

mrmiddleclass1
Observer

Goal - I am searching for  "number of actions per unique customer" metrics from API metric logs.

below is my query. Below query is filtering results by providing specific request.path and then getting stats by Customer_Id and _time.  and then getting the total count as uniqueCustomers and sum up those counts so that it will get the totalActions and the res is actually diving totalActions/uniqueCustomers

 

index="some_index" sourcetype="api-index" message="Metrics Information" | rex field=request.path "/v1/actions-api/(?<Customer_Id>\w+)" | stats count by Customer_Id, _time | eventstats count as uniqueCustomers | eventstats sum(count) as totalActions  | eval result = totalActions/uniqueCustomers 

 

 
The problem is that I don't know how to count these result per day. I tried below but isn't working because it has two BY clauses. Please suggest some solutions. Thank you

 

| bin _time span=1d

 

 

Labels (6)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

To get per-day stats, use bin span=1d _time.  Other fields won't get you per-day info.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mrmiddleclass1
Observer

Thanks for the reply. As I mentioned above, I tried bin span=1d _time but it isn't working probably because I have multiple BY clause 

bin span=1d _time

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It should work.  Please show the full query with the bin command and explain what is not working.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...