topic splunk SPL in Splunk Search

splunk SPL

vikram1583 — Tue, 08 Oct 2019 20:43:24 GMT

my search | stats count(eval(Code="3011648")) as "Incorrect login code" I am counting incorrect login code from this I want to divide count by week Monday Tuesday Wednesday Thursday Friday Saturday and Sunday in Realtime I want to count last seven days in a dashboard

Can some one help me please

Re: splunk SPL

richgalloway — Tue, 08 Oct 2019 21:55:27 GMT

Try this.

my search Code="3011648" earliest=-7d | stats count as "Incorrect login code" by date_wday

Re: splunk SPL

jdhunter — Wed, 30 Sep 2020 02:25:02 GMT

Try this:

your search
|bin _time span=1d
| stats count(eval(like(Code, "3011648"))) as Incorrect_Login by _time

I would avoid real time searches

Re: splunk SPL

vikram1583 — Tue, 08 Oct 2019 22:35:49 GMT

Thanks for the Response Its working But days are not coming in an order I want it in an order like Monday Tuesday Wednesday ------- sunday

Re: splunk SPL

richgalloway — Tue, 08 Oct 2019 23:56:19 GMT

So sort them.

my search Code="3011648" earliest=-7d | stats count as "Incorrect login code" by date_wday
| eval sorter = case(date_wday="Monday",1, date_wday="Tuesday",2, date_wday="Wednesday",3, date_wday="Thursday",4, date_wday="Friday",5, date_wday="Saturday",6, date_wday="Sunday",7)
| sort sorter | fields - sorter

Re: splunk SPL

vikram1583 — Wed, 09 Oct 2019 00:00:43 GMT

Not working