Splunk Search

Splunk search basic queries

gurkiratsingh
Explorer

Hi so suppose in my results there are 2 logs that are being retrieved. There is a status message which is either true or false. I want the color to be set to green when both of them are true. What I want to ask is that when both the statuses are true then only does splunk set the color to be green? What if one is true and one is false? If I want to give this type of a condition a seperate color is that possible?
index=*** ----------
|eventstats count as message_count |eval number=message_count
|eval color=case( (number)>2,"#ff9933",(status=="true" AND number==2),"#008000",(status=="false" AND number==2),"#FF0000")
|table color

0 Karma

wmyersas
Builder

Can you give some sample data you're trying to correlate?

How do you know LogA and LogB are reporting on "the same" thing?

0 Karma

jpolvino
Builder

How are the 2 logs differentiated? By index, or by source, or by some other attribute? Whatever that is, your case statement needs to check for "true" coming from both of those logs, and then set the color to green. Your eventstats is summing all the events, and not differentiating.

Can you please post a sample of events from both logs?

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...