https://community.splunk.com/t5/Reporting/Report-on-a-saved-search/m-p/49903#M1055 <P>Add " | stats count" to the end of your search to show the count of events, in your example "3".</P> Tue, 14 Sep 2010 23:24:06 GMT hulahoop 2010-09-14T23:24:06Z https://community.splunk.com/t5/Reporting/Report-on-a-saved-search/m-p/49902#M1054 <P>Hello, After playing with Splunk, I was able to create a save search that would email us if an IP address has more than 500 failed attempts on our firewalls. The search runs every 60 mins.</P> <P>Next, I would like to create a weekly summary report. i.e if 1.1.1.1 triggers an alert 3 separate times in the previous week, then the report will show 3. I tried creating a report on the saved search and having it run once a week, but that method displayed how many total fail attempts for the week, not the count. I’m not sure how to create a report on a save search or if I need to write a more complex search query. Thanks for your help.</P> Tue, 14 Sep 2010 23:05:36 GMT https://community.splunk.com/t5/Reporting/Report-on-a-saved-search/m-p/49902#M1054 jnguy 2010-09-14T23:05:36Z https://community.splunk.com/t5/Reporting/Report-on-a-saved-search/m-p/49903#M1055 <P>Add " | stats count" to the end of your search to show the count of events, in your example "3".</P> Tue, 14 Sep 2010 23:24:06 GMT https://community.splunk.com/t5/Reporting/Report-on-a-saved-search/m-p/49903#M1055 hulahoop 2010-09-14T23:24:06Z