About gehinger

gehinger · ‎04-03-2017

You can pipe a table after your stats and then rename your table fields: base_search | stats count by field1,field2| table field1 field2 count | rename field1 as NewFieldName1

gehinger · ‎04-03-2017

The query itself won't give you this ability. However, all queries are stored in the _audit index. So you could search this index for the desired queries and then output the result into a lookup file. index=_audit action=search

gehinger · ‎06-29-2016

Thanks for the answer 🙂 In the meantime, I found almost the same solution. Didn't do it with a list but with multiple "append" which is not as sexy. Regards,

gehinger · ‎06-29-2016

Hi everyone, I am trying to show a graph based on a "count by", but where columns are still shown, even if no result returned. For example, I have the following stats: In this example, the problem is I have no result for values 4 to 9. So, when representing results, I have the following graph: Is there a way so I can show columns, even for empty results, but still with a count=0 (so not adding fake events). Thank you in advance. Regards, Guillaume.

gehinger · ‎06-10-2015

Hi, I also would like to use the Sophos app with 6.2, but i see this is still not supported. When I add the app, I do not see the add-on in the deployment console. Shouldn't it be there so I can push it to my forwarders? Is it related to the fact this is not supported in 6.2 yet? Thank you in advance. Regards, GE.

Posts	5
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎03-02-2015

Online Status	Offline
Date Last Visited	‎07-11-2020 11:03 AM

How to get a "count by" search to display empty co...

Re: Rename a Column When Using Stats Function

Re: How to push the search query to lookup file

Re: How to get a "count by" search to display empt...

How to get a "count by" search to display empty co...

Re: is the splunk add-on for sophos also supported...