Splunk Search

how to calculate multiple stats count?

desi
New Member

i have following data

playdate, adid, store, 
2011-08-23, 1 , s1
2011-08-23, 2, s2
2011-08-23, 1, s2
2011-08-25, 2, s2

i need to calculate calculate:

How many time each adid played on each playdate

and in how many stores the adid played on each playdate

adid    playdate    #of plays on each day       #of stores play on each day
1       2011-08-23  2                               2
2       2011-08-23  1                               1
2       2011-08-25  1                               1

Here is what i tried but no data returned

search..|stats count BY adid, playdate| stats sum BY adid, playdate, store

hope i explain properly

thanks

Tags (2)
0 Karma

sideview
SplunkTrust
SplunkTrust

Assuming the 'playdate' time is getting recognized by Splunk and used as the index time, then I think this is what you're looking for:

<search...> | bin _time span="1d" | stats dc(adid) dc(store) by adid, _time
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...