Splunk Search

How do I write a search that outputs a table where each Computer_Name has 3+ variables and their counts

kkas
Path Finder

So I am trying to output audit failures in a readable manner while displaying relevant data.
I am trying to output the count for the number of times that Process_Name has failed and display its top Task_Category and have this table for each computer_name the user logged in on.

I am trying to get a table that looks like this

Computer_Name         | Process_Name       | Task_Category | count
_______________________________________________________________
asdfkjhfu$             |wineventExample1 |Login             |20
                       |wineventExample3 |Sensitive Priv    |30
                       |wineventExample2 |derp              |10
________________________________________________________________
asdflkja$              |wineventExample1 |Login             |60
                       |wineventExample5 |Sensitive Priv    |40
                       |wineventExample2 |derp              |20

My Search for now looks as follows (I know I'm not close, but this will give you an idea of field names/sourcetypes:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"|stats count(Process_Name) as count by Process_Name|appendcols [search sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"|top limit=1 TaskCategory by Process_Name|fields TaskCategory]|table Computer_Name, Process_Name,  TaskCategory,count

This outputs a table like this

 Computer_Name         | Process_Name       | Task_Category | count
    _______________________________________________________________
                           |wineventExample1 |Login             |20
                           |wineventExample3 |Sensitive Priv    |30
                           |wineventExample2 |derp              |10
Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"| stats count BY Computer_Name Process_Name Task_Category | stats list(*) AS * by Computer_Name

View solution in original post

woodcock
Esteemed Legend

Try this:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"| stats count BY Computer_Name Process_Name Task_Category | stats list(*) AS * by Computer_Name

kkas
Path Finder

That worked!!! Really appreciate your help!
I knew there was a list command, but I literally couldn't find any examples for it, so I got stuck haha.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...