Splunk Search

How to Get the list of success values in 'If' condition?

kiran007
Explorer

Hi,

I need list of all the successful events details in the 'If' condition. For those successful list I need to extract few more details and send alert. 

I tried stats count it is giving only count and for the eventstats it is giving all the values(Success and Failed events).

Please help me here to get the detail list of successful events.

Please see the below attachment.

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Honestly, I don't understand. If a single event constitutes either a success or failure, why do the stats at all?

Just do an eval as you're doing and then filter out your events with | where. You can even skip the eval at all.

<your_base_search> | rex/eval/whatever | where Time>2000

Or am I missing something here?

kiran007
Explorer

Thanks Rick

Actually, I'm very new to splunk. Exploring and Experimenting Splunk:grinning_face:

0 Karma

PickleRick
SplunkTrust
SplunkTrust

No worries. Everyone has to start somewhere :slightly_smiling_face:

Have fun with Splunk!

0 Karma

kiran007
Explorer

I'm getting complete events output if I use eventstats. I want only success event list.

Please help me out.

Please see the attachment.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...