hello
I use the request below but i would like to have an example of doing this code more performant following splunk best practices
could you help me please?
index="windows" sourcetype="wineventlog:Application" SourceName="*"
Type="Critique" OR Type="Avertissement" OR Type="Erreur"
| dedup host
| stats count by host
| join host [search index="windows-wmi" sourcetype="WMI:ModelPC" |rex "Model=(?<model>.*)"|stats values(model) as Model by host]
| stats count values(host) by Model | rename count as Total | table Model Total | sort -Total limit=10
Please try like below ( I haven't tested it, but just the concept)
[index="windows" sourcetype="wineventlog:Application" SourceName="*" (Type="Critique" OR Type="Avertissement" OR Type="Erreur" ) | stats count by host | fields host] index="windows-wmi" sourcetype="WMI:ModelPC"
|rex "Model=(?<model>.*)"|stats values(model) as Model by host
Please try like below ( I haven't tested it, but just the concept)
[index="windows" sourcetype="wineventlog:Application" SourceName="*" (Type="Critique" OR Type="Avertissement" OR Type="Erreur" ) | stats count by host | fields host] index="windows-wmi" sourcetype="WMI:ModelPC"
|rex "Model=(?<model>.*)"|stats values(model) as Model by host
thanks a lot