your a star! ... View more

Hi, how are you adding the showperc=f like this? (eventtype="wineventlog_system") source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="*" (Type="Error" OR Type="Warning") * | sort -count | top limit=10 host | top hosts showperc=f when I add this to my search the bar chart doesn't show the true info afterwards they all display 1 count only. yes the bar chart is part of the dashboard. ... View more

thanks for this I have amended your seach to (eventtype="wineventlog_application" OR eventtype="wineventlog_system") source="*inEventLog:*" (host="*" OR ComputerName="*") TaskCategory="*" SourceName="*" EventCode="*" (Type="Error" OR Type"Warning) * | sort -count | top limit=10 host so this will do a 15 min refresh and this searches application and system event logs on windows servers and does errors and warnings. i hope this is what i need. thanks ... View more

HI, We have an app called Splunk App for Windows Infrastructure which is all defined. when we choose Windows and then event monitoring from the Apps bar we get options for type, source name, event code etc. when we open the hosts event monitoring in a search we get the search as eventtype="wineventlog_common" source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="*" Type="Error" * | stats sparkline as "Trend", count by host | sort -count but this doesn't supply what i actually want. I want to get the top 5 servers giving the most errors and warnings from their event logs application and system within the last say 30 mins or realtime with the rate of change happening. but im puzzled as to how i get to this. i have run the index=win* | head 1000 which displays all my event log info form my servers. ... View more

i have looked at your answer and this is not what i want i have sent the searches i thought would be what i want have you checked these? ... View more

I have read through the tutorials before but i am looking for something like eventtype="wineventlog_application" source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="" Type="" * | sort -count | top limit=10 host would this be what im looking for or something like eventtype="wineventlog_common" source="inEventLog:Application" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="" Type="Error" * | top limit=10 host ... View more

eventtype="wineventlog_common" source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="" Type="" * | top limit=10 host eventtype="wineventlog_common" source="inEventLog:System" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="" Type="Warning" * | stats sparkline as "Trend", count by host | sort -count top limit=10 host eventtype="wineventlog_system" source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="" Type="" * | top limit=10 host eventtype="wineventlog_application" source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="" Type="" * | top limit=10 host These display the relevant event logs but i wanted to add the error and warning into a single search and have this displayed on a dashboard. i saw this eventtype="wineventlog_common" source="inEventLog:Application" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="" Type="Error" * | stats sparkline as "Trend", count by host | sort -count but cannot limit to top 10 hosts or add the AND to the type. any help would be appreciated ... View more