Splunk Search

Splunk Query to check two Conditions

prakashsbk
Explorer

Hi All

We are trying to get the incidents which are in open state (ie AlertStatus only equal to CREATE) .

Table Out is below :

prakashsbk_0-1696862234229.png

Here IncidentID 1414821 has both AlertStatus = CLEAR and CREATE , this Incident ID should not get displayed . We need IncidentID only with Alertstaus = CREATE.

we ran with

| eval IncidentID=case(AlertStatus="CREATE" AND AlertStatus!="CLEAR",IncidentID)
| table IncidentID AlertStatus 

When we run an Query it should only Display IncidentID value 1437718


 

Thanks and Regards

 

 

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @prakashsbk,

could you share your search?

you should use something like this:

<your_search>
| stats dc(AlertStatus) AS AlertStatus_count values(AlertStatus) AS AlertStatus BY IncidentID
| search AlertStatus_count<2 AND AlertStatus = "CREATE"
| table IncidentID AlertStatus 

having your search I could be more detailed.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @prakashsbk,

could you share your search?

you should use something like this:

<your_search>
| stats dc(AlertStatus) AS AlertStatus_count values(AlertStatus) AS AlertStatus BY IncidentID
| search AlertStatus_count<2 AND AlertStatus = "CREATE"
| table IncidentID AlertStatus 

having your search I could be more detailed.

Ciao.

Giuseppe

prakashsbk
Explorer

Thanks a lot for your quick help and support , Query is working as expected.

 

 

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...