Splunk Search

Please help creating a chart that combines counts of two different event types

splunker991
New Member

I defined two eventypes: "loginAttempt" and "loginSuccess".  Now I am trying to create a chart where counts of both of these events are displayed side by side, per hour, to create a visual representation of the gap between attempted vs successful logins for each hour.

Tabular representation would be something like:

Date | Hour | Count of Attempts | Count of Successful

I got individual counts working, but having a hard time figuring out how to combine the two while adding them up per hour.  Any help is greatly appreciated.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| timechart span=1h count by eventtype
0 Karma

splunker991
New Member

Thank you, looks like I was overthinking it...

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...