topic Re: report only specific eventtypes in Splunk Search

report only specific eventtypes

EricPartington — Sun, 29 May 2011 02:51:19 GMT

I would like to report only on specific eventtypes.

I have a search that returns the eventtypes that i want to chart vs. each other (firewall-accept vs firewall-deny). But I also have a number of other eventtypes that apply to this data that also show up in this search (eventtype=cisco_firewall)

How can I only show the two eventtypes that I care about in the timechart (accept vs deny)

Re: report only specific eventtypes

mw — Sun, 29 May 2011 13:04:34 GMT

Your search could either look something like:

(eventtype="firewall-accept" OR eventtype="firewall-deny") other search terms | timechart count by eventtype

or it could filter to the eventtypes

... | eval a=mvfilter(eventtype == "firewall-accept" or eventtype == "firewall-deny") | search a=* | timechart count by a

The first would probably be the cleanest way, if you're able to use either method.

Re: report only specific eventtypes

EricPartington — Sun, 29 May 2011 15:55:45 GMT

The second query works like a charm, thanks

Re: report only specific eventtypes

klaurean — Mon, 02 Jul 2012 14:49:18 GMT

I had this same problem and the second option was perfect. Thank you!

Re: report only specific eventtypes

mfscully — Sun, 05 Apr 2015 12:51:26 GMT

Second option solved my problem as well! Thanks!

Re: report only specific eventtypes

stollefsen — Mon, 25 Jul 2016 16:12:34 GMT

Neither 2 options worked for me in version 6.x.x. Interesting. I went back and disabled the one eventtype, I needed removed in my dashboard.