How to display search results by day

[kaphie2002]

Hello,

  I have a search that calculates the total number of a specific log event and displays results in the table format below:

col1 col2 col3 col4
23 25 26 27

How do I display the results by day? for example:

_time col1 col2 col3
2018-05-03 270 23 35
2018-05-04 814 33 25
Total xxxx 56 60

Thanks,

[woodcock]

Just add an appropriately placed | bin span=1d _time and then add _time to the BY clause of your stats command.

[somesoni2]

You'd get a better answer if you could share your current search. Depending upon you current search (how you calculated values for those columns) you'd use timechart or bin-stats or bin-chart combination.

[rgreer]

The Timechart command (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip) or the bin command. Either of those commands would do what your looking for. I would start with the timechart command and expand from there.