Splunk Search

Please help creating a chart that combines counts of two different event types

splunker991
New Member

I defined two eventypes: "loginAttempt" and "loginSuccess".  Now I am trying to create a chart where counts of both of these events are displayed side by side, per hour, to create a visual representation of the gap between attempted vs successful logins for each hour.

Tabular representation would be something like:

Date | Hour | Count of Attempts | Count of Successful

I got individual counts working, but having a hard time figuring out how to combine the two while adding them up per hour.  Any help is greatly appreciated.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| timechart span=1h count by eventtype
0 Karma

splunker991
New Member

Thank you, looks like I was overthinking it...

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...