Splunk search basic queries

[gurkiratsingh]

Hi so suppose in my results there are 2 logs that are being retrieved. There is a status message which is either true or false. I want the color to be set to green when both of them are true. What I want to ask is that when both the statuses are true then only does splunk set the color to be green? What if one is true and one is false? If I want to give this type of a condition a seperate color is that possible?
index=*** ----------
|eventstats count as message_count |eval number=message_count
|eval color=case( (number)>2,"#ff9933",(status=="true" AND number==2),"#008000",(status=="false" AND number==2),"#FF0000")
|table color


[wmyersas]

Can you give some sample data you're trying to correlate?

How do you know LogA and LogB are reporting on "the same" thing?

[jpolvino]

How are the 2 logs differentiated? By index, or by source, or by some other attribute? Whatever that is, your case statement needs to check for "true" coming from both of those logs, and then set the color to green. Your eventstats is summing all the events, and not differentiating.

Can you please post a sample of events from both logs?