How to Get the list of success values in 'If' condition?

[kiran007]

Hi,

I need list of all the successful events details in the 'If' condition. For those successful list I need to extract few more details and send alert. 

I tried stats count it is giving only count and for the eventstats it is giving all the values(Success and Failed events).

Please help me here to get the detail list of successful events.

Please see the below attachment.

[PickleRick]

Honestly, I don't understand. If a single event constitutes either a success or failure, why do the stats at all?

Just do an eval as you're doing and then filter out your events with | where. You can even skip the eval at all.

<your_base_search> | rex/eval/whatever | where Time>2000

Or am I missing something here?

[kiran007]

Thanks Rick

Actually, I'm very new to splunk. Exploring and Experimenting Splunk😀. 

[PickleRick]

No worries. Everyone has to start somewhere 🙂

Have fun with Splunk!

[kiran007]

I'm getting complete events output if I use eventstats. I want only success event list.

Please help me out.

Please see the attachment.