Splunk Search

How to search the count of failed logs per month for the past six months?

syed_star357
New Member

Hi,

I want to generate the monthly report for the past six months and need the count of failed logs for each month.

Example:

July Count 20
June Count 15
.....
....
....
Jan Count 50.

But the search below is not giving correct the output, Is there any way to get the monthly count of failed logs for the past six months?

index=networksecurity Protocol=Radius signature =Failed_Attempts | stats count by date_month, date_year
0 Karma

sundareshr
Legend

Try this

 index=networksecurity Protocol=Radius signature=* earliest=-6mon@mon latest=@mon|timechart span=1mon dc(user) AS Users_Count,count(eval(signature="Failed_Attempts")) AS Total_Failed_Attempts
0 Karma

Ravan
Path Finder

This should give you unique no of users count and total failed attempts by each month. You may need to change the user filed name as per your log data.

index=networksecurity Protocol=Radius signature=Failed_Attempts  earliest=-6mon@mon latest=@mon|timechart span=1mon dc(user) AS Users_Count,count(signature) AS Total_Failed_Attempts  
0 Karma

JDukeSplunk
Builder

Maybe this?

index=networksecurity Protocol=Radius signature =Failed_Attempts earliest="-6mon@mon" latest="@mon" | timechart span=1mon count(signature) as Total
0 Karma

syed_star357
New Member

Thanks, I want the count like total number of users and Total Failed_Attempts

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...