hello
I use the request below, which works:
index="windows" sourcetype="wineventlog:Application" "SourceName=*" Type="Critique" OR Type="Avertissement"
| dedup _time SourceName
| table _time SourceName |
stats count by SourceName
| rename SourceName as Application count as Erreurs
| sort - Erreurs limit=10
I try to do the count also by host
so i do this :
index="windows" sourcetype="wineventlog:Application" "SourceName=*" Type="Critique" OR Type="Avertissement"
| dedup _time SourceName
| table _time SourceName |
stats count by SourceName host
| rename SourceName as Application count as Erreurs
| sort - Erreurs limit=10
but it doesn't work.
could you help me?
The reason second search doesn't work because your table command (line 3) restricts the fields in result to _time and SourceName only. There is not host field after that table command, thus next stats doesn't work.
You can try something like this
index="windows" sourcetype="wineventlog:Application" "SourceName=*" Type="Critique" OR Type="Avertissement"
| stats dc(_time) as Erreurs by SourceName host
| rename SourceName as Application
| sort - Erreurs limit=10
many thanks for all your perfect answer
Hey,
You can also use the top
function like that :
index="windows" sourcetype="wineventlog:Application" "SourceName=*" Type="Critique" OR Type="Avertissement"
| top 10 SourceName,host
That should return you the same result than the =search you were writing.
KailA
The reason second search doesn't work because your table command (line 3) restricts the fields in result to _time and SourceName only. There is not host field after that table command, thus next stats doesn't work.
You can try something like this
index="windows" sourcetype="wineventlog:Application" "SourceName=*" Type="Critique" OR Type="Avertissement"
| stats dc(_time) as Erreurs by SourceName host
| rename SourceName as Application
| sort - Erreurs limit=10
Hello @jip31,
First of all, you do not need to do dedup if you will do a stats count, you will have the same result and stats count is faster.
Table is only aesthetic, so you do not need to do it at first, or maybe use fields, to have a faster query, but I think it will not be necessary.
And, ah! You had a typo with the field Source name!
Try this query:
index="windows" sourcetype="wineventlog:Application" SourceName=* Type="Critique" OR Type="Avertissement"
| stats count by SourceName host
| rename SourceName as Application count as Erreurs
| sort - Erreurs limit=10