Splunk Search

Splunk search basic queries

gurkiratsingh
Explorer

Hi so suppose in my results there are 2 logs that are being retrieved. There is a status message which is either true or false. I want the color to be set to green when both of them are true. What I want to ask is that when both the statuses are true then only does splunk set the color to be green? What if one is true and one is false? If I want to give this type of a condition a seperate color is that possible?
index=*** ----------
|eventstats count as message_count |eval number=message_count
|eval color=case( (number)>2,"#ff9933",(status=="true" AND number==2),"#008000",(status=="false" AND number==2),"#FF0000")
|table color

0 Karma

wmyersas
Builder

Can you give some sample data you're trying to correlate?

How do you know LogA and LogB are reporting on "the same" thing?

0 Karma

jpolvino
Builder

How are the 2 logs differentiated? By index, or by source, or by some other attribute? Whatever that is, your case statement needs to check for "true" coming from both of those logs, and then set the color to green. Your eventstats is summing all the events, and not differentiating.

Can you please post a sample of events from both logs?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...