Reporting

Report on a saved search?

jnguy
New Member

Hello, After playing with Splunk, I was able to create a save search that would email us if an IP address has more than 500 failed attempts on our firewalls. The search runs every 60 mins.

Next, I would like to create a weekly summary report. i.e if 1.1.1.1 triggers an alert 3 separate times in the previous week, then the report will show 3. I tried creating a report on the saved search and having it run once a week, but that method displayed how many total fail attempts for the week, not the count. I’m not sure how to create a report on a save search or if I need to write a more complex search query. Thanks for your help.

Tags (2)
0 Karma

hulahoop
Splunk Employee
Splunk Employee

Add " | stats count" to the end of your search to show the count of events, in your example "3".

Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...