Splunk Search

stats count by date

nk-1
Path Finder

earliest=10/1/2016:00:00:00 latest=10/2/2016:23:59:59 sourcetype=iis | stats count by date

date count
2016-10-01 500
2016-10-02 707
2016-10-03 205

earliest=10/1/2016:00:00:00 latest=10/2/2016:23:59:59 sourcetype=iis | eval date=strftime(_time, "%Y-%m-%d") | stats count by date

date count
2016-10-01 705
2016-10-02 707

Why does the first query return 3 rows, especially when 10/3/2016 is not a part of the search time range?

1 Solution

sideview
SplunkTrust
SplunkTrust

Date isn't a default field in Splunk, so it's pretty much the big unknown here, what those values being logged by IIS actually are/mean. Who knows.

If you want to see a count for the last few days technically you want to be using timechart.

earliest=10/1/2016:00:00:00 latest=10/2/2016:23:59:59 sourcetype=iis | timechart span=1d count

Anyway, as to why there's a date value being returned that's outside of the timerange, my guess is that in those 205 events, for some semantic reason inside the events themselves, the "date" the event is talking about is actually in the (then) future.

One way to find out more is to run this:

earliest=10/1/2016:00:00:00 latest=10/2/2016:23:59:59 sourcetype=iis | stats last(_raw) as rawtext count by date

And it will grab a sample of the rawtext for each of your three rows.

View solution in original post

0 Karma

sundareshr
Legend

It seems like there is a field called date in your event. The field that is used for _time is not the date field.

0 Karma

sideview
SplunkTrust
SplunkTrust

Date isn't a default field in Splunk, so it's pretty much the big unknown here, what those values being logged by IIS actually are/mean. Who knows.

If you want to see a count for the last few days technically you want to be using timechart.

earliest=10/1/2016:00:00:00 latest=10/2/2016:23:59:59 sourcetype=iis | timechart span=1d count

Anyway, as to why there's a date value being returned that's outside of the timerange, my guess is that in those 205 events, for some semantic reason inside the events themselves, the "date" the event is talking about is actually in the (then) future.

One way to find out more is to run this:

earliest=10/1/2016:00:00:00 latest=10/2/2016:23:59:59 sourcetype=iis | stats last(_raw) as rawtext count by date

And it will grab a sample of the rawtext for each of your three rows.

0 Karma

nk-1
Path Finder

Thanks guys!
Yes, MS IIS defines a "date" field in its log format that becomes part of the Splunk event.
And that date/time appears to be in GMT (future).

Software: Microsoft Internet Information Services 8.5

Version: 1.0

Date: 2016-10-04 00:00:00

Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken

0 Karma

sideview
SplunkTrust
SplunkTrust

Great! 😃 I wonder how many others have gotten tangled up in this.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...