Splunk Search

splunk SPL

vikram1583
Explorer

my search | stats count(eval(Code="3011648")) as "Incorrect login code" I am counting incorrect login code from this I want to divide count by week Monday Tuesday Wednesday Thursday Friday Saturday and Sunday in Realtime I want to count last seven days in a dashboard

Can some one help me please

0 Karma

jdhunter
Path Finder

Try this:

your search
|bin _time span=1d
| stats count(eval(like(Code, "3011648"))) as Incorrect_Login by _time

I would avoid real time searches

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this.

my search Code="3011648" earliest=-7d | stats count as "Incorrect login code" by date_wday
---
If this reply helps you, Karma would be appreciated.
0 Karma

vikram1583
Explorer

Thanks for the Response Its working But days are not coming in an order I want it in an order like Monday Tuesday Wednesday ------- sunday

0 Karma

richgalloway
SplunkTrust
SplunkTrust

So sort them.

my search Code="3011648" earliest=-7d | stats count as "Incorrect login code" by date_wday
| eval sorter = case(date_wday="Monday",1, date_wday="Tuesday",2, date_wday="Wednesday",3, date_wday="Thursday",4, date_wday="Friday",5, date_wday="Saturday",6, date_wday="Sunday",7)
| sort sorter | fields - sorter
---
If this reply helps you, Karma would be appreciated.
0 Karma

vikram1583
Explorer

Not working

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...