Splunk Search

How do I write a search that outputs a table where each Computer_Name has 3+ variables and their counts

kkas
Path Finder

So I am trying to output audit failures in a readable manner while displaying relevant data.
I am trying to output the count for the number of times that Process_Name has failed and display its top Task_Category and have this table for each computer_name the user logged in on.

I am trying to get a table that looks like this

Computer_Name         | Process_Name       | Task_Category | count
_______________________________________________________________
asdfkjhfu$             |wineventExample1 |Login             |20
                       |wineventExample3 |Sensitive Priv    |30
                       |wineventExample2 |derp              |10
________________________________________________________________
asdflkja$              |wineventExample1 |Login             |60
                       |wineventExample5 |Sensitive Priv    |40
                       |wineventExample2 |derp              |20

My Search for now looks as follows (I know I'm not close, but this will give you an idea of field names/sourcetypes:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"|stats count(Process_Name) as count by Process_Name|appendcols [search sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"|top limit=1 TaskCategory by Process_Name|fields TaskCategory]|table Computer_Name, Process_Name,  TaskCategory,count

This outputs a table like this

 Computer_Name         | Process_Name       | Task_Category | count
    _______________________________________________________________
                           |wineventExample1 |Login             |20
                           |wineventExample3 |Sensitive Priv    |30
                           |wineventExample2 |derp              |10
Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"| stats count BY Computer_Name Process_Name Task_Category | stats list(*) AS * by Computer_Name

View solution in original post

woodcock
Esteemed Legend

Try this:

sourcetype=wineventlog:forwardedevents Account_Name=Alpha Keywords="Audit Failure"| stats count BY Computer_Name Process_Name Task_Category | stats list(*) AS * by Computer_Name

kkas
Path Finder

That worked!!! Really appreciate your help!
I knew there was a list command, but I literally couldn't find any examples for it, so I got stuck haha.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...