splunk SPL

[vikram1583]

my search | stats count(eval(Code="3011648")) as "Incorrect login code" I am counting incorrect login code from this I want to divide count by week Monday Tuesday Wednesday Thursday Friday Saturday and Sunday in Realtime I want to count last seven days in a dashboard

Can some one help me please

[jdhunter]

Try this:

your search
|bin _time span=1d
| stats count(eval(like(Code, "3011648"))) as Incorrect_Login by _time

I would avoid real time searches

[richgalloway]

Try this.

my search Code="3011648" earliest=-7d | stats count as "Incorrect login code" by date_wday

[vikram1583]

Thanks for the Response Its working But days are not coming in an order I want it in an order like Monday Tuesday Wednesday ------- sunday

[richgalloway]

So sort them.

my search Code="3011648" earliest=-7d | stats count as "Incorrect login code" by date_wday
| eval sorter = case(date_wday="Monday",1, date_wday="Tuesday",2, date_wday="Wednesday",3, date_wday="Thursday",4, date_wday="Friday",5, date_wday="Saturday",6, date_wday="Sunday",7)
| sort sorter | fields - sorter

[vikram1583]

Not working