Splunk Search

How do I write a search that outputs a table where each Computer_Name has 3+ variables and their counts

kkas
Path Finder

So I am trying to output audit failures in a readable manner while displaying relevant data.
I am trying to output the count for the number of times that Process_Name has failed and display its top Task_Category and have this table for each computer_name the user logged in on.

I am trying to get a table that looks like this

Computer_Name         | Process_Name       | Task_Category | count
_______________________________________________________________
asdfkjhfu$             |wineventExample1 |Login             |20
                       |wineventExample3 |Sensitive Priv    |30
                       |wineventExample2 |derp              |10
________________________________________________________________
asdflkja$              |wineventExample1 |Login             |60
                       |wineventExample5 |Sensitive Priv    |40
                       |wineventExample2 |derp              |20

My Search for now looks as follows (I know I'm not close, but this will give you an idea of field names/sourcetypes:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"|stats count(Process_Name) as count by Process_Name|appendcols [search sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"|top limit=1 TaskCategory by Process_Name|fields TaskCategory]|table Computer_Name, Process_Name,  TaskCategory,count

This outputs a table like this

 Computer_Name         | Process_Name       | Task_Category | count
    _______________________________________________________________
                           |wineventExample1 |Login             |20
                           |wineventExample3 |Sensitive Priv    |30
                           |wineventExample2 |derp              |10
Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"| stats count BY Computer_Name Process_Name Task_Category | stats list(*) AS * by Computer_Name

View solution in original post

woodcock
Esteemed Legend

Try this:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"| stats count BY Computer_Name Process_Name Task_Category | stats list(*) AS * by Computer_Name

kkas
Path Finder

That worked!!! Really appreciate your help!
I knew there was a list command, but I literally couldn't find any examples for it, so I got stuck haha.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...