hello
I use the search below in order to do a total count by OS and by build
It mean that it counts only events which have a build AND an OS
I would like to do another count but this time I would like to do a total count of events which have a build OR an OS
Could you help me please??
eventtype="AppliEV" | fields Name, Level, host
| dedup host
| stats count by host
| join host type="outer"
[ search index="x" sourcetype=x key_path="x"
OR
key_path="x"
| eval OS=if(key_path=="x"),
Build=if(key_path=="x"
| stats latest(OS) as OS latest(Build) as Build by host]
| stats values(OS) as OS values(Build) as Build by host
| stats count as Total by OS Build
One way to approach that would be:
eventtype="AppliEV" | fields Name, Level, host
| dedup host
| stats count by host
| join host type="outer"
[ search index="x" sourcetype=x key_path="x"
OR
key_path="x"
| eval OS=if(key_path=="x"),
Build=if(key_path=="x"
| stats latest(OS) as OS latest(Build) as Build by host]
| stats values(OS) as OS values(Build) as Build by host
| fillnull value="unknown" OS,Build
| stats count as Total by OS Build
By using fillnull, every event will have an OS and a Build value (value is set to "unknown" when it did not have a value).
One way to approach that would be:
eventtype="AppliEV" | fields Name, Level, host
| dedup host
| stats count by host
| join host type="outer"
[ search index="x" sourcetype=x key_path="x"
OR
key_path="x"
| eval OS=if(key_path=="x"),
Build=if(key_path=="x"
| stats latest(OS) as OS latest(Build) as Build by host]
| stats values(OS) as OS values(Build) as Build by host
| fillnull value="unknown" OS,Build
| stats count as Total by OS Build
By using fillnull, every event will have an OS and a Build value (value is set to "unknown" when it did not have a value).
Many thanks franck