Splunk Search

How to get Success, In Progress and Failure Count from this data

agar1122
New Member

I have this kind of data,

 

Event IDEvent StepStatus 
1001SUCCESS 
1002SUCCESS 
1003FAILURE 
1004FAILURE 
1005SUCCESS 
1006FAILURE 

 

Success Condition : When Event Steps 1,2,4 and 5 ALL are SUCCESS , then SUCESS, Else it is in PROGRESS.

Can you help me with the query to find out the same.

I have tried AND Condition, but it is not giving me correct result, because it searches for one condition only.

I have tried OR as well, but that gives me wrong count.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to evaluate the status of each step and recombine them into a single row per event (stats), then evaluate your success condition

...
| eval status1=if(step=1,status,null)
| eval status2=if(step=2,status,null)
| eval status3=if(step=3,status,null)
| eval status4=if(step=4,status,null)
| eval status5=if(step=5,status,null)
| eval status6=if(step=6,status,null)
| stats values(status1) as status1, values(status2) as status2, values(status3) as status3, values(status4) as status4, values(status5) as status5, values(status6) as status6 by event
| eval overall=if(status1="SUCCESS" AND status2="SUCCESS" AND status4="SUCCESS" AND status5="SUCCESS", "SUCCESS", "IN PROGRESS")
| table event, overall

 

Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...