We've built a report for ~150 hosts and a big filtered list of the eventlogs. My fields are Host, EventCode, SourceName, sourcetype, Message & Count. Currently, I have a count of eventcodes per host, but it's been requested that I get a count of eventcodes of all the hosts, preferably in the same report.
Also, my message field is truncated to 75 characters. It's also been requested that the full message be readable as easily as possible. Below is my query:
(index=server OR index=lansweeper OR index=wineventlog OR index=windows OR index=adhoc_audit) tag::host=PHI (source="WinEventLog:System" OR source="WinEventLog:Security" OR source="WinEventLog:Application" OR source="WinEventLog:Directory Service" OR source=ls-winevent) SourceName!=TAAG.SchedulingService SourceName!=Paradigm.PCMS.Session SourceName!=W32Time SourceName!="ASP.NET*" SourceName!=".NET Runtime" SourceName!=Microsoft-Windows-WAS SourceName!=Paradigm.Vito.PCMS.Session SourceName!=LogSrcTraxCS.Message997I5 SourceName!=MSSQL$* SourceName!="Windows Update Agent" SourceName!="Phantom Call service" SourceName!=SQLISPackage100 EventCode!=592 EventCode!=593 EventCode!=562 EventCode!=567 EventCode!=540 EventCode!=564 EventCode!=538 EventCode!=594 EventCode!=600 EventCode!=560 SourceName!="Director Agent" SourceName!=MR_MONITOR EventCode!=18264 SourceName!="Microsoft-Windows-WMI" SourceName!=vmStatsProvider SourceName!=".NET Runtime 2.0 Error Reporting" EventCode!=6013 EventCode!=4634 SourceName!="Microsoft-Windows-Kernel-General" SourceName!=SQLISPackage EventCode!=7036 | eval Message=substr(Message,1,75) | stats count(EventCode) as COUNT by host, EventCode,SourceName,sourcetype, Message | sort + COUNT
So, I'm thinking it would look something like EventCode Count, then expanding the eventcode would give me a list of hosts and their count. Is this possible in Splunk?
Swap this:
.... | stats count(EventCode) as COUNT by host, EventCode,SourceName,sourcetype, Message | sort + COUNT
for this:
... | top limit=0 EventCode by host | addtotals col=t row=f labelfield=host label="TOTAL"
That gave me host,eventcode,count,percent fields, and I'm uncertain what the percentage ... is a percentage of.
Looks like I need to get off my nethers and learn to work w/ Pivot tables.