Splunk Search

report only specific eventtypes

Communicator

I would like to report only on specific eventtypes.

I have a search that returns the eventtypes that i want to chart vs. each other (firewall-accept vs firewall-deny). But I also have a number of other eventtypes that apply to this data that also show up in this search (eventtype=cisco_firewall)

How can I only show the two eventtypes that I care about in the timechart (accept vs deny)

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Your search could either look something like:

(eventtype="firewall-accept" OR eventtype="firewall-deny") other search terms | timechart count by eventtype

or it could filter to the eventtypes

... | eval a=mvfilter(eventtype == "firewall-accept" or eventtype == "firewall-deny") | search a=* | timechart count by a

The first would probably be the cleanest way, if you're able to use either method.

View solution in original post

New Member

Neither 2 options worked for me in version 6.x.x. Interesting. I went back and disabled the one eventtype, I needed removed in my dashboard.

0 Karma

Splunk Employee
Splunk Employee

Your search could either look something like:

(eventtype="firewall-accept" OR eventtype="firewall-deny") other search terms | timechart count by eventtype

or it could filter to the eventtypes

... | eval a=mvfilter(eventtype == "firewall-accept" or eventtype == "firewall-deny") | search a=* | timechart count by a

The first would probably be the cleanest way, if you're able to use either method.

View solution in original post

Explorer

Second option solved my problem as well! Thanks!

0 Karma

Engager

I had this same problem and the second option was perfect. Thank you!

0 Karma

Communicator

The second query works like a charm, thanks

0 Karma