Splunk Search

Splunk Query to check two Conditions

prakashsbk
Explorer

Hi All

We are trying to get the incidents which are in open state (ie AlertStatus only equal to CREATE) .

Table Out is below :

prakashsbk_0-1696862234229.png

Here IncidentID 1414821 has both AlertStatus = CLEAR and CREATE , this Incident ID should not get displayed . We need IncidentID only with Alertstaus = CREATE.

we ran with

| eval IncidentID=case(AlertStatus="CREATE" AND AlertStatus!="CLEAR",IncidentID)
| table IncidentID AlertStatus 

When we run an Query it should only Display IncidentID value 1437718


 

Thanks and Regards

 

 

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @prakashsbk,

could you share your search?

you should use something like this:

<your_search>
| stats dc(AlertStatus) AS AlertStatus_count values(AlertStatus) AS AlertStatus BY IncidentID
| search AlertStatus_count<2 AND AlertStatus = "CREATE"
| table IncidentID AlertStatus 

having your search I could be more detailed.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @prakashsbk,

could you share your search?

you should use something like this:

<your_search>
| stats dc(AlertStatus) AS AlertStatus_count values(AlertStatus) AS AlertStatus BY IncidentID
| search AlertStatus_count<2 AND AlertStatus = "CREATE"
| table IncidentID AlertStatus 

having your search I could be more detailed.

Ciao.

Giuseppe

prakashsbk
Explorer

Thanks a lot for your quick help and support , Query is working as expected.

 

 

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...