Mongo Collection Data : -
Id : 1
StartDate : some date
EndDate : Some Date
X :
Foo : “foo1’
Count : 10
Id : 2
StartDate : some date
EndDate : Some Date
X :
Foo : “foo2’
Count : 5
Id : 3
StartDate : some date
EndDate : Some Date
X :
bar : “bar1’
Count : 20
I do not understand the way that you have presented your data. I also do not understand the desire. It helps greatly if you present sample raw events and desired output mockup.
hi,
not clear what you want. but append cols will only work if you have values in all the fields that you are basing your append cols on.
for example:
| appendcols StatDate [search.....]
unless the start dates are common across all the sub searches you are using the appendcols will not work.
the mongodb JSON you are consuming for id1,2 & 3 are they in the same index?
Consider using stats command rather than append or join
This is nearly what i m looking for
https://answers.splunk.com/answers/204291/use-of-count-by-date-in-metadata-typehosts.html
host 12/04/14 12/05/14 12/06/14 ...
A 5 10 ...
B 27 12 ...
C 48 40 ...
D 95 25 ...
the mongodb JSON you are consuming for id1,2 & 3 are they in the same index? Yes.
I have "| appendcols StatDate [search.....] but my result is over the places.
I'm going to try below SPLunk Query
source="PS_VM_Config" VMCDMedia="True" earliest=-72h | stats count(VMName) AS ConnectedDays, Values(VCenter) AS VCenter BY VMName | where ConnectedDays > 2 | join [search source="PS_VM_Config" VMCDMedia="True" earliest=-24h] | table VMName VCenter
I am searching for word foo & bar on daily basis, weekly, monthly - and my output should be in
Daily Result
Monday
Foo appeared 1 times
Bar appreard 2
Tuseday
Foo appeared 1 times
Bar appreard 2
.............
Weekly
Foo appeared 10 times
Bar appreard 0
Week 1
Foo appeared 10 times
Bar appreard 0
Week 2
Bar appreard 50 Time0
Monthly Result
Foo appeared 10 times
Bar appreard 0
i have used append Columns but by result is proprly displayed
StartDate EndDate Bar . count1 count2
someDate some date . 20
StartDate EndDate Bar . count1 count2
someDate some date . 0
only same index