Splunk Search

How do I write a search that outputs a table where each Computer_Name has 3+ variables and their counts

kkas
Path Finder

So I am trying to output audit failures in a readable manner while displaying relevant data.
I am trying to output the count for the number of times that Process_Name has failed and display its top Task_Category and have this table for each computer_name the user logged in on.

I am trying to get a table that looks like this

Computer_Name         | Process_Name       | Task_Category | count
_______________________________________________________________
asdfkjhfu$             |wineventExample1 |Login             |20
                       |wineventExample3 |Sensitive Priv    |30
                       |wineventExample2 |derp              |10
________________________________________________________________
asdflkja$              |wineventExample1 |Login             |60
                       |wineventExample5 |Sensitive Priv    |40
                       |wineventExample2 |derp              |20

My Search for now looks as follows (I know I'm not close, but this will give you an idea of field names/sourcetypes:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"|stats count(Process_Name) as count by Process_Name|appendcols [search sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"|top limit=1 TaskCategory by Process_Name|fields TaskCategory]|table Computer_Name, Process_Name,  TaskCategory,count

This outputs a table like this

 Computer_Name         | Process_Name       | Task_Category | count
    _______________________________________________________________
                           |wineventExample1 |Login             |20
                           |wineventExample3 |Sensitive Priv    |30
                           |wineventExample2 |derp              |10
Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"| stats count BY Computer_Name Process_Name Task_Category | stats list(*) AS * by Computer_Name

View solution in original post

woodcock
Esteemed Legend

Try this:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"| stats count BY Computer_Name Process_Name Task_Category | stats list(*) AS * by Computer_Name

kkas
Path Finder

That worked!!! Really appreciate your help!
I knew there was a list command, but I literally couldn't find any examples for it, so I got stuck haha.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...