https://community.splunk.com/t5/Splunk-Search/how-to-write-query-to-show-only-failure-records-from-the/m-p/401350#M168744 <P>When I run with the above command :I got this message "no results found yet". Right now I dont have failed records so should I trust this query as correct?</P> Mon, 25 Jun 2018 11:04:07 GMT Malliv 2018-06-25T11:04:07Z https://community.splunk.com/t5/Splunk-Search/how-to-write-query-to-show-only-failure-records-from-the/m-p/401348#M168742 <P>index=axway* sourcetype="<EM>:messages" SENDERROUTINGID="KNPROD" |stats count by PRODUCTIONFILENAME|fields - count |rename PRODUCTIONFILENAME as FileName |join type=left FileName [search index=axway</EM> APPLICATION="CRD_3PL_TO_S4_GOODSRCPT" STATE=* | eval temp=split(FILENAME,"/")| eval count=mvcount(temp)| eval FileName=mvindex(temp,-1) |eval status=if(STATE like "%COMPLETE%" ,"Success","Failure") |stats latest(status) as status by APPLICATION FileName |stats count(eval(status="Failure")) as FailureCount by FileName APPLICATION status |replace CRD_3PL_TO_S4_GOODSRCPT<BR /> WITH "IDD_CRD_SCS_022" IN APPLICATION |rename APPLICATION as InterfaceID ] |eval Applicationstatus_MFT=if(status="_", "Failure","Success") |table InterfaceID FileName Applicationstatus_MFT |stats count(FileName) as FileVolume count(eval(Applicationstatus_MFT!="Success")) as FailFileCount by InterfaceID Applicationstatus_MFT</P> Tue, 29 Sep 2020 20:08:10 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-query-to-show-only-failure-records-from-the/m-p/401348#M168742 Malliv 2020-09-29T20:08:10Z https://community.splunk.com/t5/Splunk-Search/how-to-write-query-to-show-only-failure-records-from-the/m-p/401349#M168743 <P>You can just add <CODE>| search ApplicationStatus_MFT!="Success"</CODE> after your eval that creates Applicationstatus_MFT. </P> <P>Though if you area only showing failures you may be able to remove some of the other pieces from your query. </P> Fri, 22 Jun 2018 13:38:33 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-query-to-show-only-failure-records-from-the/m-p/401349#M168743 kmaron 2018-06-22T13:38:33Z https://community.splunk.com/t5/Splunk-Search/how-to-write-query-to-show-only-failure-records-from-the/m-p/401350#M168744 <P>When I run with the above command :I got this message "no results found yet". Right now I dont have failed records so should I trust this query as correct?</P> Mon, 25 Jun 2018 11:04:07 GMT https://community.splunk.com/t5/Splunk-Search/how-to-write-query-to-show-only-failure-records-from-the/m-p/401350#M168744 Malliv 2018-06-25T11:04:07Z