Splunk Search

How do I write a search that outputs a table where each Computer_Name has 3+ variables and their counts

kkas
Path Finder

So I am trying to output audit failures in a readable manner while displaying relevant data.
I am trying to output the count for the number of times that Process_Name has failed and display its top Task_Category and have this table for each computer_name the user logged in on.

I am trying to get a table that looks like this

Computer_Name         | Process_Name       | Task_Category | count
_______________________________________________________________
asdfkjhfu$             |wineventExample1 |Login             |20
                       |wineventExample3 |Sensitive Priv    |30
                       |wineventExample2 |derp              |10
________________________________________________________________
asdflkja$              |wineventExample1 |Login             |60
                       |wineventExample5 |Sensitive Priv    |40
                       |wineventExample2 |derp              |20

My Search for now looks as follows (I know I'm not close, but this will give you an idea of field names/sourcetypes:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"|stats count(Process_Name) as count by Process_Name|appendcols [search sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"|top limit=1 TaskCategory by Process_Name|fields TaskCategory]|table Computer_Name, Process_Name,  TaskCategory,count

This outputs a table like this

 Computer_Name         | Process_Name       | Task_Category | count
    _______________________________________________________________
                           |wineventExample1 |Login             |20
                           |wineventExample3 |Sensitive Priv    |30
                           |wineventExample2 |derp              |10
Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"| stats count BY Computer_Name Process_Name Task_Category | stats list(*) AS * by Computer_Name

View solution in original post

woodcock
Esteemed Legend

Try this:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"| stats count BY Computer_Name Process_Name Task_Category | stats list(*) AS * by Computer_Name

kkas
Path Finder

That worked!!! Really appreciate your help!
I knew there was a list command, but I literally couldn't find any examples for it, so I got stuck haha.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...