Splunk Search

Search query for a report to match 3 fields

karthik4455
Explorer

I am trying to create a report where same engineer has escalated a ticket and resolved it. Like Ticket 13440211 was escalated by shan and also closed by him as well. How can I create a query for this?

Ticket      status      Engineer    count   

1 13440238 ESCALATED shan 10

2 13440211 CLOSED shan 74

3 13440211 ESCALATED shan 74

4 13440188 ESCALATED shan 2

5 13440144 ESCALATED shan 2

6 13440143 ESCALATED chan 15

6 13440143 CLOSED chan 15
7 13440143 ESCALATED shan 14

Tags (2)
1 Solution

kristian_kolb
Ultra Champion

Something like:

index=blah sourcetype=bleh STATUS=ESCALATED OR STATUS=CLOSED| transaction Ticket | where mvcount(Engineer) = 1

could work.

/K

View solution in original post

kristian_kolb
Ultra Champion

Something like:

index=blah sourcetype=bleh STATUS=ESCALATED OR STATUS=CLOSED| transaction Ticket | where mvcount(Engineer) = 1

could work.

/K

somesoni2
SplunkTrust
SplunkTrust

Try this

index=hfgtrdaily status=* ty=* STATUS=ESCALATED OR STATUS=CLOSED| search Engineer!=system | transaction Ticket | where mvcount(Engineer) = 1

karthik4455
Explorer

I am including this to my search but I receive error "Unknown search command 'index'."

index=hfgtrdaily status=* ty=* | search Engineer!=system | index=blah sourcetype=bleh STATUS=ESCALATED OR STATUS=CLOSED| transaction Ticket | where mvcount(Engineer) = 1

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...