Splunk Search

Search query for a report to match 3 fields

karthik4455
Explorer

I am trying to create a report where same engineer has escalated a ticket and resolved it. Like Ticket 13440211 was escalated by shan and also closed by him as well. How can I create a query for this?

Ticket      status      Engineer    count   

1 13440238 ESCALATED shan 10

2 13440211 CLOSED shan 74

3 13440211 ESCALATED shan 74

4 13440188 ESCALATED shan 2

5 13440144 ESCALATED shan 2

6 13440143 ESCALATED chan 15

6 13440143 CLOSED chan 15
7 13440143 ESCALATED shan 14

Tags (2)
1 Solution

kristian_kolb
Ultra Champion

Something like:

index=blah sourcetype=bleh STATUS=ESCALATED OR STATUS=CLOSED| transaction Ticket | where mvcount(Engineer) = 1

could work.

/K

View solution in original post

kristian_kolb
Ultra Champion

Something like:

index=blah sourcetype=bleh STATUS=ESCALATED OR STATUS=CLOSED| transaction Ticket | where mvcount(Engineer) = 1

could work.

/K

somesoni2
Revered Legend

Try this

index=hfgtrdaily status=* ty=* STATUS=ESCALATED OR STATUS=CLOSED| search Engineer!=system | transaction Ticket | where mvcount(Engineer) = 1

karthik4455
Explorer

I am including this to my search but I receive error "Unknown search command 'index'."

index=hfgtrdaily status=* ty=* | search Engineer!=system | index=blah sourcetype=bleh STATUS=ESCALATED OR STATUS=CLOSED| transaction Ticket | where mvcount(Engineer) = 1

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...