Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: how to sum everyday result
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this is my search srcipt, it will show everyday use some apps count
sourcetype="acclog" app="molly" OR app="wms" |timechart span="1d" dc(IP) as visitor by app |sort visitor
the result like
_time Molly wms
12-7-10 22 265
12-7-11 3 22
how can i sum the total count, like below
app counter
Molly 25
wms 287
Could someone can help me ? Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ah ... missed your point completely. In that case you can use eval to create a new field with IP and date combined.
... | eval X=IP.date_year.date_month.date_mday | stats dc(X) as visitor by app | ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ah ... missed your point completely. In that case you can use eval to create a new field with IP and date combined.
... | eval X=IP.date_year.date_month.date_mday | stats dc(X) as visitor by app | ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Kallu, thanks your help.
yes, this is what i want ^___^
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
... | stats dc(IP) as visitor by app | sort visitor
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i try this , but it didn't count erveyday. if some IP is in
2 day, it's counter will be "1", but i want 2
Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...
Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions
Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...
