i have following data
playdate, adid, store,
2011-08-23, 1 , s1
2011-08-23, 2, s2
2011-08-23, 1, s2
2011-08-25, 2, s2
i need to calculate calculate:
How many time each adid
played on each playdate
and in how many stores the adid
played on each playdate
adid playdate #of plays on each day #of stores play on each day
1 2011-08-23 2 2
2 2011-08-23 1 1
2 2011-08-25 1 1
Here is what i tried but no data returned
search..|stats count BY adid, playdate| stats sum BY adid, playdate, store
hope i explain properly
thanks
Assuming the 'playdate' time is getting recognized by Splunk and used as the index time, then I think this is what you're looking for:
<search...> | bin _time span="1d" | stats dc(adid) dc(store) by adid, _time