Hi all,
We have installed splunk 6.0.1.
when we try to use stats count by source type we have a results of all 8 sourcetype we have. If we combine sourcetype and date_hour we have a results of only two sourcetype
It's correct or some goes wrong?
This are search I'm using
earliest=-2h@h latest=@h | stats count by sourcetype
WinEventLog:Application 5269
WinEventLog:Security 2138
WinEventLog:System 345
WinEventLog:application 12408
WinEventLog:security 9347
WinEventLog:system 286
linux_messages 16066
vmw-esx 32392
earliest=-2h@h latest=@h | stats count by sourcetype,date_hour
linux_messages 14 6535
linux_messages 15 9536
vmw-esx 12 24669
vmw-esx 13 7723
Thanks
Those Windows sourcetypes probably don't have the field date_hour
- that only exists if the timestamp is properly extracted from the event, I remember Windows sourcetypes might use indextime assignment instead. Try this as an alternative:
earliest=-2h@h latest=@h | bin span=1h _time | stats count by sourcetype _time
Slightly different point, but counting by sourcetype can be done much faster using tstats
.
| tstats count by sourcetype _time span=1h
Those Windows sourcetypes probably don't have the field date_hour
- that only exists if the timestamp is properly extracted from the event, I remember Windows sourcetypes might use indextime assignment instead. Try this as an alternative:
earliest=-2h@h latest=@h | bin span=1h _time | stats count by sourcetype _time
Slightly different point, but counting by sourcetype can be done much faster using tstats
.
| tstats count by sourcetype _time span=1h
Thanks, your search works perfectly, we try to use tstats. Thank you