https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-of-failed-logs-per-month-for-the-past/m-p/282962#M85473 <P>Hi,</P> <P>I want to generate the monthly report for the past six months and need the count of failed logs for each month.</P> <P>Example:</P> <P>July Count 20<BR /> June Count 15<BR /> .....<BR /> ....<BR /> ....<BR /> Jan Count 50.</P> <P>But the search below is not giving correct the output, Is there any way to get the monthly count of failed logs for the past six months?</P> <PRE><CODE>index=networksecurity Protocol=Radius signature =Failed_Attempts | stats count by date_month, date_year </CODE></PRE> Thu, 28 Jul 2016 04:34:16 GMT syed_star357 2016-07-28T04:34:16Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-of-failed-logs-per-month-for-the-past/m-p/282962#M85473 <P>Hi,</P> <P>I want to generate the monthly report for the past six months and need the count of failed logs for each month.</P> <P>Example:</P> <P>July Count 20<BR /> June Count 15<BR /> .....<BR /> ....<BR /> ....<BR /> Jan Count 50.</P> <P>But the search below is not giving correct the output, Is there any way to get the monthly count of failed logs for the past six months?</P> <PRE><CODE>index=networksecurity Protocol=Radius signature =Failed_Attempts | stats count by date_month, date_year </CODE></PRE> Thu, 28 Jul 2016 04:34:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-of-failed-logs-per-month-for-the-past/m-p/282962#M85473 syed_star357 2016-07-28T04:34:16Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-of-failed-logs-per-month-for-the-past/m-p/282963#M85474 <P>Maybe this?</P> <PRE><CODE>index=networksecurity Protocol=Radius signature =Failed_Attempts earliest="-6mon@mon" latest="@mon" | timechart span=1mon count(signature) as Total </CODE></PRE> Thu, 28 Jul 2016 15:00:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-of-failed-logs-per-month-for-the-past/m-p/282963#M85474 JDukeSplunk 2016-07-28T15:00:03Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-of-failed-logs-per-month-for-the-past/m-p/282964#M85475 <P>Thanks, I want the count like total number of users and Total Failed_Attempts</P> Tue, 02 Aug 2016 08:29:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-of-failed-logs-per-month-for-the-past/m-p/282964#M85475 syed_star357 2016-08-02T08:29:12Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-of-failed-logs-per-month-for-the-past/m-p/282965#M85476 <P>This should give you unique no of users count and total failed attempts by each month. You may need to change the user filed name as per your log data.</P> <PRE><CODE>index=networksecurity Protocol=Radius signature=Failed_Attempts earliest=-6mon@mon latest=@mon|timechart span=1mon dc(user) AS Users_Count,count(signature) AS Total_Failed_Attempts </CODE></PRE> Tue, 02 Aug 2016 09:24:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-of-failed-logs-per-month-for-the-past/m-p/282965#M85476 Ravan 2016-08-02T09:24:06Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-of-failed-logs-per-month-for-the-past/m-p/282966#M85477 <P>Try this</P> <PRE><CODE> index=networksecurity Protocol=Radius signature=* earliest=-6mon@mon latest=@mon|timechart span=1mon dc(user) AS Users_Count,count(eval(signature="Failed_Attempts")) AS Total_Failed_Attempts </CODE></PRE> Sun, 07 Aug 2016 17:32:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-count-of-failed-logs-per-month-for-the-past/m-p/282966#M85477 sundareshr 2016-08-07T17:32:15Z