Splunk Search

splunk SPL

vikram1583
Explorer

my search | stats count(eval(Code="3011648")) as "Incorrect login code" I am counting incorrect login code from this I want to divide count by week Monday Tuesday Wednesday Thursday Friday Saturday and Sunday in Realtime I want to count last seven days in a dashboard

Can some one help me please

0 Karma

jdhunter
Path Finder

Try this:

your search
|bin _time span=1d
| stats count(eval(like(Code, "3011648"))) as Incorrect_Login by _time

I would avoid real time searches

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this.

my search Code="3011648" earliest=-7d | stats count as "Incorrect login code" by date_wday
---
If this reply helps you, Karma would be appreciated.
0 Karma

vikram1583
Explorer

Thanks for the Response Its working But days are not coming in an order I want it in an order like Monday Tuesday Wednesday ------- sunday

0 Karma

richgalloway
SplunkTrust
SplunkTrust

So sort them.

my search Code="3011648" earliest=-7d | stats count as "Incorrect login code" by date_wday
| eval sorter = case(date_wday="Monday",1, date_wday="Tuesday",2, date_wday="Wednesday",3, date_wday="Thursday",4, date_wday="Friday",5, date_wday="Saturday",6, date_wday="Sunday",7)
| sort sorter | fields - sorter
---
If this reply helps you, Karma would be appreciated.
0 Karma

vikram1583
Explorer

Not working

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...