Splunk Search

search query - iterations of search criteria

david_rundle_fi
Explorer

I'm trying to search for multiple rule event hits in my historical data:

Date 1, Rule A, NumAlerts 15
Date 1, Rule B, NumAlerts 0
Date 1, Rule C, NumAlerts 15000
Date 2, Rule A, NumAlerts 16000
Date 2, Rule B, NumAlerts 16
Date 3, Rule C, NumAlerts 1

How would I structure a query for any given date range (Last 3 days)
Rule A - 16015
Rule B - 16
Rule C - 15001

0 Karma

aholzer
Motivator

You can use stats with a sum and a by statement. Like so:

<base_search> | stats sum(NumAlerts) by Rule

The time range you can specify using custom time, go to "relative" and use -3d@d. You can also add "earliest=-3d@d latest=now" to your so you force the search to be for the past 3 days without taking into consideration the users timerange selection.

Hope this helps.

david_rundle_fi
Explorer

You RAWK! Woohoo!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...