Splunk Search

Chart sum as well as the source numbers

MattQ
Explorer

I would like to return a chart that has
LOGIN SUCCESS
LOGIN FAILURE
and TOTAL LOGIN ATTEMPTS.

In my logs I return raw text of LOGIN SUCCESS and LOGIN FAILURE.

I can search and return everything with "LOGIN" and chart that over time. How do I then subsearch for the raw text in those results for "SUCCESS" and separately "FAILURE" and return the count of all three in a timechart. (the top line - all login, should equal the total of the SUCCESS and FAILURE).

I am looking to produce this for trending to spot anomalies.

Essentially
... AND ("LOGIN SUCCESS" OR "LOGIN FAILURE") |timechart count

but how do I get this to return as two separate count lines?

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Create a field extraction for the login action (see http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsatsearchtime ) then split your timechart by this field.

... | timechart count by login_action

(or whatever you choose to call your field)

You can then choose to stack your chart so that you get a total count in the chart that way.

View solution in original post

0 Karma

Ayn
Legend

Create a field extraction for the login action (see http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsatsearchtime ) then split your timechart by this field.

... | timechart count by login_action

(or whatever you choose to call your field)

You can then choose to stack your chart so that you get a total count in the chart that way.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...