Splunk Search

count of a field, and then sort by day

barneser
Engager

Im looking to count by a field and that works with first part of syntex , then sort it by date.
both work independantly ,but not together.

Any ideas?

index=profile_new| stats count(cn1) by cs2 | stats count as daycount by date_mday

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@barneser

Can you please share more details with sample output?? meanwhile can you please try this ?

index=profile_new | chart count(cn1) over date_mday by cs2 | sort date_mday

gcusello
SplunkTrust
SplunkTrust

Hi @barneser,
after a stats command, you have only the fields that you used in the stats command.
So in your example, after the first stats command you have only count(cn1) and cs2, you haven't more date_mday or other fields.
If you need another field you have to add it to stats command using values or earliest (for dates).
For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Stats .

Anyway, if you could describe better what you want to have as result, I could help you, because I don't understand your requisite.

In other words, if you run a statistic for cs2, what do you mean with "sort by date"?

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...