×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
vishwasgopala
Engager
Member since: ‎12-24-2021
‎01-07-2022
Community Statistics
Posts 1
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎12-24-2021
View All

filter by only failed events which never passed

by in Splunk Search
‎12-24-2021 02:24 AM
‎12-24-2021 02:24 AM
INFO [] () process='isValid', result='failed', dacNumber='[DAC_111_646]',  accountNumber=1122333 INFO [] () process='isValid', result='failed', dacNumber='[DAC_111_777]',  accountNumber=1122333 INFO [] () process='isValid', result='failed', dacNumber='[DAC_111_888]',  accountNumber=1122333  INFO [] () process='isValid', result='success', dacNumber='[DAC_111_777]',  accountNumber=1122333  INFO [] () process='isValid', result='success', dacNumber='[DAC_111_999]',  accountNumber=1122333  INFO [] () process='isValid', result='success', dacNumber='[DAC_111_646]',  accountNumber=1122333   How to get all failed dacNumber which never passed.  In the above example it should give me DAC_111_777. Please help.   ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎01-07-2022 01:22 AM