index=summary_winevents source="Summary - Hourly Bugchecks" ExpandCsv(orig_host,"$groupname$") ExpandCsv(orig_host,"$computername$") | appendpipe [inputlookup bsod_samples.csv] | rename orig_host as host | stats list(StopCode) AS StopCode, list(P1) AS P1, list(P2) AS P2, list(P3) AS P3, list(P4) AS P4 by _time, host | bucket _time span=7d | sort - _time | eval Time = strftime(_time,"%m/%d/%Y") | stats count as Occurrences by Time, StopCode, host | eval StopCode=substr(StopCode, 9) | stats count as Occurrences by Time, StopCode | chart sum(Occurrences) limit=35 over Time by StopCode
... View more