Reporting

Report on a saved search?

jnguy
New Member

Hello, After playing with Splunk, I was able to create a save search that would email us if an IP address has more than 500 failed attempts on our firewalls. The search runs every 60 mins.

Next, I would like to create a weekly summary report. i.e if 1.1.1.1 triggers an alert 3 separate times in the previous week, then the report will show 3. I tried creating a report on the saved search and having it run once a week, but that method displayed how many total fail attempts for the week, not the count. I’m not sure how to create a report on a save search or if I need to write a more complex search query. Thanks for your help.

Tags (2)
0 Karma

hulahoop
Splunk Employee
Splunk Employee

Add " | stats count" to the end of your search to show the count of events, in your example "3".

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...