I have this search to see logins to our splunk environment: index = _audit user="*" action="login attempt" info=succeeded | stats count by user mgmt is asking to see the same data but i...
...ield) is max. How can I use eval in stats to have this? something like this: | stats values(eval(title4 where value is max)) AS title4 BY title1 How can I do it? Ciao....
With the assistance of this forum, I managed to combine the events of two sourcetypes and run stats to correlate the fields on a single shared field between the two sourcetypes. The problem is, w...
...ut how to add the values function. | stats count as attack_number by FQDN,uri
| stats values(attack_type) as "Types of attack" For each FQDN/uri I want to have the number of attacks, and all t...
...eed to filter out name that contain "2" and stats count name based on location. I came up with this search, but the problem is it did not include location A (because the count is zero) P...
...trftime(_time,"%Y/%m/%d %H:%M:%S")
| rex "^.+transactType:\s(?P<transactType>(.\w+)+)"
| stats values(Fecha) as Fecha, values(transactType) as transactType by ID
This is Ok, if i want count t...
Hi Splunk Team I am having issues while fetching data from 2 stats count fields together. Below is the query: index=test_index | rex "\.(?<TestMQ>.*)\@" | eval Priority_Level=case(P...
Hello-
I am attempting to make a table and hopefully be able to integrate it into a dashboard.
Goal is to interrogate on two fields and pull stats accordingly.
FieldA has multiple v...