Splunk Search

Please help creating a chart that combines counts of two different event types

splunker991
New Member

I defined two eventypes: "loginAttempt" and "loginSuccess".  Now I am trying to create a chart where counts of both of these events are displayed side by side, per hour, to create a visual representation of the gap between attempted vs successful logins for each hour.

Tabular representation would be something like:

Date | Hour | Count of Attempts | Count of Successful

I got individual counts working, but having a hard time figuring out how to combine the two while adding them up per hour.  Any help is greatly appreciated.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| timechart span=1h count by eventtype
0 Karma

splunker991
New Member

Thank you, looks like I was overthinking it...

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...