I am writing a search query that looks for hosts that have appeared for the first time today and their count. Here is what I was thinking: < my search > | stats count last(date_year) AS first_year last(date_month) AS first_month last(date_mday) AS first_day BY host | where first_year=today's year AND first_month=today's month AND first_day=today's day Is there a function in Splunk that returns today's year, month and day that would make the above search query work? ... View more

Let's say I have a field called "host" and it can take the following values: host1, host2, host3. I'm having trouble writing a query which displays the number of hits each host had today and the average number of hits it has had over all time. A hit is defined as the host appearing in the field so if I had an event where host=host1 - that would count as a hit for host1 (essentially a count). The output would look something like this: Hits_Today Average_Hits_over_all_time host1 5 10 host2 12 3 host3 23 16 Any advice? ... View more