Splunk Search

count of a field, and then sort by day

barneser
Engager

Im looking to count by a field and that works with first part of syntex , then sort it by date.
both work independantly ,but not together.

Any ideas?

index=profile_new| stats count(cn1) by cs2 | stats count as daycount by date_mday

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@barneser

Can you please share more details with sample output?? meanwhile can you please try this ?

index=profile_new | chart count(cn1) over date_mday by cs2 | sort date_mday

gcusello
SplunkTrust
SplunkTrust

Hi @barneser,
after a stats command, you have only the fields that you used in the stats command.
So in your example, after the first stats command you have only count(cn1) and cs2, you haven't more date_mday or other fields.
If you need another field you have to add it to stats command using values or earliest (for dates).
For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Stats .

Anyway, if you could describe better what you want to have as result, I could help you, because I don't understand your requisite.

In other words, if you run a statistic for cs2, what do you mean with "sort by date"?

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...