Splunk Search

Getting the counts by day but keeping the timestamp

totaro
Explorer

Hi,
Messing with dns logs im trying to get the domain that was only queried afew times per day. However i would also like to keep the timestamp so i know the time of query as well, any way i can do this? my current method is
"|stats count by Date,Query|where count < 5 " but this remove the timestamp

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi totaro,

try something like this:

base search here
| stats count values(timestamp) AS timestamp by Date, Query
| where count < 5

this will keep a single or multivalve field with the timestamp in it.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try these:

... | eventstats count BY Date Query | where count < 5 

OR

...  | stats count list(_time) AS _time BY Date Query | where count < 5
0 Karma

MuS
Legend

Hi totaro,

try something like this:

base search here
| stats count values(timestamp) AS timestamp by Date, Query
| where count < 5

this will keep a single or multivalve field with the timestamp in it.

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...