Splunk Search

splunk SPL

Explorer

my search | stats count(eval(Code="3011648")) as "Incorrect login code" I am counting incorrect login code from this I want to divide count by week Monday Tuesday Wednesday Thursday Friday Saturday and Sunday in Realtime I want to count last seven days in a dashboard

Can some one help me please

0 Karma

Path Finder

Try this:

your search
|bin _time span=1d
| stats count(eval(like(Code, "3011648"))) as Incorrect_Login by _time

I would avoid real time searches

0 Karma

SplunkTrust
SplunkTrust

Try this.

my search Code="3011648" earliest=-7d | stats count as "Incorrect login code" by date_wday
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Thanks for the Response Its working But days are not coming in an order I want it in an order like Monday Tuesday Wednesday ------- sunday

0 Karma

SplunkTrust
SplunkTrust

So sort them.

my search Code="3011648" earliest=-7d | stats count as "Incorrect login code" by date_wday
| eval sorter = case(date_wday="Monday",1, date_wday="Tuesday",2, date_wday="Wednesday",3, date_wday="Thursday",4, date_wday="Friday",5, date_wday="Saturday",6, date_wday="Sunday",7)
| sort sorter | fields - sorter
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Not working

0 Karma