Splunk Search

Splunk search basic queries


Hi so suppose in my results there are 2 logs that are being retrieved. There is a status message which is either true or false. I want the color to be set to green when both of them are true. What I want to ask is that when both the statuses are true then only does splunk set the color to be green? What if one is true and one is false? If I want to give this type of a condition a seperate color is that possible?
index=*** ----------
|eventstats count as message_count |eval number=message_count
|eval color=case( (number)>2,"#ff9933",(status=="true" AND number==2),"#008000",(status=="false" AND number==2),"#FF0000")
|table color

0 Karma


Can you give some sample data you're trying to correlate?

How do you know LogA and LogB are reporting on "the same" thing?

0 Karma


How are the 2 logs differentiated? By index, or by source, or by some other attribute? Whatever that is, your case statement needs to check for "true" coming from both of those logs, and then set the color to green. Your eventstats is summing all the events, and not differentiating.

Can you please post a sample of events from both logs?

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...