Hi
I use the request below in order to count degradation stop performances by service name
index="windows" sourcetype="wineventlog:microsoft-windows-diagnostics-performance/operational" Type=* OpCode="Détérioration de l’arrêt" TaskCategory="Analyse des performances d’arrêt" Nom_du_fichier=* "Durée de la dégradation"=*
| stats dc(Durée de la dégradation) as Total by Nom_du_fichier | sort -Total limit=10
You can see the result here
https://cjoint.com/c/IAdiC08SQZd
Now, I want to match these requests with this one :
index="windows-fr" sourcetype=WinRegistry key_path=\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry | eval NATCO=if(key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry",data, null)
| stats values(NATCO) as NATCO by host
| stats dc(host) as host by NATCO | sort -NATCO limit=10
My goal is to count degradation stop performances by service name and by NATCO.
So, I would like to have in a same table the same thing that there is in the capture but also with a NATCO column.
Could you help me please??
Just in case someone come over this question, I suggested OP to use "Join" Command : https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Join
He came up with the following search
index="windows" sourcetype="wineventlog:microsoft-windows-diagnostics-performance/operational" Type=* OpCode="Détérioration de l’arrêt" TaskCategory="Analyse des performances d’arrêt" Nom_du_fichier=* "Durée de la dégradation"=* | stats count by host
| join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry" | eval NATCO=if(key_path=="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry",data, null) | stats latest(NATCO) as NATCO by host]
| stats values(NATCO) as NATCO by host | stats count as Total by NATCO
| sort -Total limit=10
If you have a common ID, you could use "join" command : https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Join
I dont succeed...
Maybe I could help if you give events sample for your requests
I have done this
index="windows" sourcetype="wineventlog:microsoft-windows-diagnostics-performance/operational" Type=* OpCode="Détérioration de l’arrêt" TaskCategory="Analyse des performances d’arrêt" Nom_du_fichier=* "Durée de la dégradation"=* | stats count by host
| join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry" | eval NATCO=if(key_path=="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry",data, null) | stats latest(NATCO) as NATCO by host]
| stats values(NATCO) as NATCO by host | stats count as Total by NATCO
| sort -Total limit=10
so you have a common id 😉
Great to know that it helped 🙂
thanks!!!!
And no commun ID..