×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
ggiovan
Engager
Member since: ‎04-25-2017
‎06-05-2020
Community Statistics
Posts 10
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎04-25-2017
Activity Feed
View All

Re: How to edit my search to use transaction comma...

by in Splunk Search
‎05-03-2017 07:57 AM
‎05-03-2017 07:57 AM
Hi, I need to exclude all the events that start with "LOGON" and end with "LOGOFF BY CLEANUP" and that they are exactly 2 in 2 minutes. That's why I need "eventcount = 2". Thank you very much ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM
Karma given to
View All