Can you provide a Splunk search to find the count of total and failed events?

[sahil237888]

Can you provide a Splunk query to find the count of Total number of events (where field1 = "News") and out of total how many numbers are failed events (where field1 = "News" and field4 = "Media" both)

[sgundeti]

simulating your requirement

 | makeresults count=100 | eval field1="News" | appendcols [ | makeresults count=10| eval field4="Media" ] | stats count(eval(field1="News")) as f1 count(eval(field1="News" AND field4="Media")) as f4

results as

f1  f4
100 10

In your case, try like this

... field1="News" OR field4="Media" | stats count(eval(field1="News")) as Total count(eval(field1="News" AND field4="Media")) as "failed events"

[whrg]

If two queries are fine (one for total count and one for failed ount) then you can search for:

index=... ... field1="News" | stats count

and

index=... ... field1="News" field4="Media" | stats count

If you require only one search then do it as follows:

index=... ... field1="News" | stats count as total_count count(eval(field4=="Media")) as failed_count