Splunk Search

Search syntax help

kenntun
Engager

I import csv files structure like following

A Last Login Region Disable

abc@abc.com 3/23 18:00 HK No
tbc@tbc.com NULL USA Yes

I would like to make 1 chart with the following
1. Last Login != NULL AND Disable != Yes
Timechat as Region
2. Last Login = NULL AND Disable != NO
Timechat as Region

index=* source="/u01/testing.csv" sourcetype="365csv" | where "Last Login"!=NULL AND "Disable!="YES" | stats count by region

Tags (1)
0 Karma

shivanshu1593
Builder

Since there are two different condition, there'll be 2 different SPL, in my opinion. Try these and see if they might help you. In the span part, you can specify the span as per your needs. I also hope that index=* was done for obfuscating the name of the index, if not, then please specify the name of the Index, when you run this search in your environment.

First SPL:

index=* source="/u01/testing.csv" sourcetype="365csv" | where NOT "Last Login"=NULL AND Disable="YES" | timechart span=1d count by region

Second SPL:

index=* source="/u01/testing.csv" sourcetype="365csv" | search "Last Login"=NULL AND Disable!="NO" | timechart span=1d count by region
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...