topic Re: Get the list of success values in 'If' condition in Splunk Search

How to Get the list of success values in 'If' condition?

kiran007 — Mon, 11 Apr 2022 15:43:51 GMT

Hi,

I need list of all the successful events details in the 'If' condition. For those successful list I need to extract few more details and send alert.

I tried stats count it is giving only count and for the eventstats it is giving all the values(Success and Failed events).

Please help me here to get the detail list of successful events.

Please see the below attachment.

Re: Get the list of success values in 'If' condition

kiran007 — Mon, 11 Apr 2022 08:54:34 GMT

I'm getting complete events output if I use eventstats. I want only success event list.

Please help me out.

Please see the attachment.

Re: Get the list of success values in 'If' condition

PickleRick — Mon, 11 Apr 2022 10:01:43 GMT

Honestly, I don't understand. If a single event constitutes either a success or failure, why do the stats at all?

Just do an eval as you're doing and then filter out your events with | where. You can even skip the eval at all.

<your_base_search> | rex/eval/whatever | where Time>2000

Or am I missing something here?

Re: Get the list of success values in 'If' condition

kiran007 — Mon, 11 Apr 2022 11:38:09 GMT

Thanks Rick

Actually, I'm very new to splunk. Exploring and Experimenting Splunk😀.

Re: Get the list of success values in 'If' condition

PickleRick — Mon, 11 Apr 2022 11:43:03 GMT

No worries. Everyone has to start somewhere 🙂

Have fun with Splunk!