Splunk Search

how to calculate multiple stats count?

desi
New Member

i have following data

playdate, adid, store, 
2011-08-23, 1 , s1
2011-08-23, 2, s2
2011-08-23, 1, s2
2011-08-25, 2, s2

i need to calculate calculate:

How many time each adid played on each playdate

and in how many stores the adid played on each playdate

adid    playdate    #of plays on each day       #of stores play on each day
1       2011-08-23  2                               2
2       2011-08-23  1                               1
2       2011-08-25  1                               1

Here is what i tried but no data returned

search..|stats count BY adid, playdate| stats sum BY adid, playdate, store

hope i explain properly

thanks

Tags (2)
0 Karma

sideview
SplunkTrust
SplunkTrust

Assuming the 'playdate' time is getting recognized by Splunk and used as the index time, then I think this is what you're looking for:

<search...> | bin _time span="1d" | stats dc(adid) dc(store) by adid, _time
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...