Splunk Search

Multiple Events - Looking for Matching Data

jon0149
New Member

I would like to show a count for every time I get a "burst" of similar events.
This would be defined as more than one event having the same data in one field across them:

So :
- Event 001 would have a "subject" field with text always in the same format subject = "Report: <EventName>"
- Event 002 would have the same setup but with either the same or a different <EventName>.

I would like to be able to view all the events where there is another event with the same <EventName> and also display the results in a Dashboard. Thereby analyzing trends between similar events.

Does anyone know how I might achieve this?

Thanks

0 Karma

Sukisen1981
Champion

Hi @jon0149 - You do need to provide a sample of your events and what you need in more clear statements, if you expect a more detailed answer.
That being said,you best bet is to
1- extract events using regex based on the eventname
2- do a stats , values, list , table of the events
3- Save as a panel in a dashboard
4- You might have a text input dropdown in your dashboard which would be the eventnames , selcting one would show you the events with timestaoms for that particular eventname across the range of your search

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...