Splunk Search

stats count by value, grouped by time

ryastrebov
Communicator

Hello!

I analyze DNS-log. I can get stats count by Domain:

| stats count by Domain 

And I can get list of domain per minute'

index=main3   |bucket span=1m _time | stats values(Domain) by _time

But I can't combine this two search... I would like to receive as a result of such a table:

_time     Domain        count
12:51     domain1.com    2
          domain2.com    5
          domain3.net    3
12:52     domain1.com    4
          domain2.com    2
          domain3.net    9

How I can make it?

Tags (1)
0 Karma
1 Solution

jstockamp
Communicator

timechart seems like a better solution here

timechart span=1m count(domain) by domain

should work.

View solution in original post

jstockamp
Communicator

timechart seems like a better solution here

timechart span=1m count(domain) by domain

should work.

ryastrebov
Communicator

Thank you!
Yes, It's work fine, but in result table contains only the most popular domains. As it can be modified to produce a table of all contained in the log domains?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...