I am a newbie in Splunk Enterprise. I have to write a splunk query to get the status of the clients accessing the application. The status will be either ERROR or SUCCESS. If the status is SUCCESS, then it is fine but if it is ERROR, it should count the number of ERROR for particular clients and should give the output in tabular format. For example lets say I have 2 clients: Amit@xyz.com and Jash@xyz.com
So the final output should be :
Client_ID Count of ERROR Amit@xyz.com 25 Jash@xyz.com 54
I tried this query : index="abc_main" sourcetype="def" STATUS=ERROR CLIENT_ID=*
So it showing the error status for all clients in the log file, but now my requirement is to get the tabular output like the example I mentioned above.