topic Re: Search query for a report to match 3 fields in Splunk Search

Search query for a report to match 3 fields

karthik4455 — Tue, 22 Jul 2014 10:05:08 GMT

I am trying to create a report where same engineer has escalated a ticket and resolved it. Like Ticket 13440211 was escalated by shan and also closed by him as well. How can I create a query for this?

Ticket      status      Engineer    count

1 13440238 ESCALATED shan 10

2 13440211 CLOSED shan 74

3 13440211 ESCALATED shan 74

4 13440188 ESCALATED shan 2

5 13440144 ESCALATED shan 2

6 13440143 ESCALATED chan 15

6 13440143 CLOSED chan 15
7 13440143 ESCALATED shan 14

Re: Search query for a report to match 3 fields

kristian_kolb — Tue, 22 Jul 2014 10:20:03 GMT

Something like:

index=blah sourcetype=bleh STATUS=ESCALATED OR STATUS=CLOSED| transaction Ticket | where mvcount(Engineer) = 1

could work.

Re: Search query for a report to match 3 fields

karthik4455 — Tue, 22 Jul 2014 10:55:59 GMT

I am including this to my search but I receive error "Unknown search command 'index'."

index=hfgtrdaily status=* ty=* | search Engineer!=system | index=blah sourcetype=bleh STATUS=ESCALATED OR STATUS=CLOSED| transaction Ticket | where mvcount(Engineer) = 1

Re: Search query for a report to match 3 fields

somesoni2 — Tue, 22 Jul 2014 13:25:51 GMT

Try this

index=hfgtrdaily status=* ty=* STATUS=ESCALATED OR STATUS=CLOSED| search Engineer!=system | transaction Ticket | where mvcount(Engineer) = 1