Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Searches from Splunk Talk

This week VS Lastweek!

`vpn` action=success earliest=-0d@d latest=now | eval ReportKey="Today" | append [search `vpn` action=success earliest=-1d@d latest=-0d@d | eval ReportKey="Last Week"   | eval new_time=_time+86400] | eval _time=if(isnotnull(new_time), new_time, _time)| timechart count by ReportKey

Sparkline for logins

 index=radius host=<VPNHOSTS> |stats sparkline count(action) as count  by action | sort -count 
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.