Splunk Search

merge two searches without available fields

rechteklebe
Path Finder

Hello,

i have two searches where the text expressions are different(without fields) (Login Successful and Unsuccessful). I'd like to have the amount of user divided by country

  1. index=123 sourcetype=123 country=* "Login successful" | stats count by country
  2. index=123 sourcetype=123 country=* "Login unsuccessful" | stats count by country

Now i would like to merge this two searches in one chart divided by the country
The table should look like:

Columns are "Country" "Login Successful" "Login unsuccessful"

1st row for example: DE 20 5

I tried to use following search:

index="123" sourcetype="123" "Login successful" OR "Login unsuccessful"
|eval Successful_Logins=searchmatch("Login successful")
|eval Unsuccessful_Logins=searchmatch("Login unsuccessful")
|stats Successful_Logins Unsuccessful Logins by country

How i can merge two searches without fields (no fields are used for "Login (un)successful")?

Thank you in advance!

Tags (4)
0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

You can use searchmatch and eval in your stats expression.

index=123 sourcetype=123 "Login successful" OR "Login unsuccessful" | stats count(eval(searchmatch("Login successful"))) as Successful_Logins count(eval(searchmatch("Login unsuccessful"))) as Unsuccessful_Logins by country

View solution in original post

dart
Splunk Employee
Splunk Employee

You can use searchmatch and eval in your stats expression.

index=123 sourcetype=123 "Login successful" OR "Login unsuccessful" | stats count(eval(searchmatch("Login successful"))) as Successful_Logins count(eval(searchmatch("Login unsuccessful"))) as Unsuccessful_Logins by country

View solution in original post

rechteklebe
Path Finder

sorry it was my fault. now your search is working fine! Thanks!

0 Karma

dart
Splunk Employee
Splunk Employee

Can you post the exact search you are running? What version of Splunk?

0 Karma

dart
Splunk Employee
Splunk Employee

This exact search worked for me against Windows Security Log Data
*| stats count(eval(searchmatch("Success Audit"))) as Successful_Logins count(eval(searchmatch("Fail* Audit"))) as Unsuccessful_Logins

0 Karma

rechteklebe
Path Finder

Error='The arguments to the 'searchmatch' function are invalid.
Another idea?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!