topic Re: How to agregate data from different sourcetypes? in Getting Data In

How to agregate data from different sourcetypes?

jip31jip31 — Tue, 10 Apr 2018 13:04:39 GMT

hello

I use the request below for retrieving some information from the Windows event viewer but in my dashboard, I need to aggregate other information from another sourcetype.
This sourcetype comes from another sourcetype ([WinHostMon://computer]] or from WMI.conf ([WMI:Computer])
My question is. how to aggregate data in my SPL command for these 2 cases?
Thanks

index="wineventlog" sourcetype="wineventlog:*" SourceName="*" Type="Critique" OR Type="Avertissement" 
| dedup host  
| stats count  
| rename count AS "Number of machines" 
| eventstats sum(count) as Total 
| eval percent=round((count/Total)*100,1) 
| eval host=host."(count: ".count.", percent: ".percent.")" 
| fields - count Total

index="wineventlog" sourcetype="wineventlog:*" SourceName="*" Type="Critique" OR Type="Avertissement" 
| dedup host  
| stats count  
| rename count AS "Number of machines" 
| eventstats sum(count) as Total 
| eval percent=round((count/Total)*100,1) 
| eval host=host."(count: ".count.", percent: ".percent.")" 
| fields - count Total

index="wineventlog" sourcetype="wineventlog:*" SourceName="*" Type="Critique" OR Type="Avertissement" 
| dedup host  
| stats count  
| rename count AS "Number of machines" 
| eventstats sum(count) as Total 
| eval percent=round((count/Total)*100,1) 
| eval host=host."(count: ".count.", percent: ".percent.")" 
| fields - count Total

We formatted your code so it was easier to see the three queries.

Re: How to agregate data from different sourcetypes?

p_gurav — Tue, 10 Apr 2018 13:33:16 GMT

Is there any common field present in all sourcetype?

Re: How to agregate data from different sourcetypes?

richgalloway — Tue, 10 Apr 2018 13:47:01 GMT

Did your query get mangled by the forum? It looks like it might be two queries stuck together.

BTW, for better performance, use stats dc(host) instead of dedup host | stats count.

Re: How to agregate data from different sourcetypes?

jip31 — Tue, 10 Apr 2018 16:19:58 GMT

ok thanks

Re: How to agregate data from different sourcetypes?

jip31 — Tue, 10 Apr 2018 16:21:53 GMT

no sorry...

Re: How to agregate data from different sourcetypes?

jip31jip31 — Wed, 11 Apr 2018 05:20:10 GMT

NOBODY FOR HELPING ME??

Re: How to agregate data from different sourcetypes?

richgalloway — Wed, 11 Apr 2018 13:41:15 GMT

Your query is difficult to understand. It looks like it might be two or three searches run together. Can you please edit the question?

Re: How to agregate data from different sourcetypes?

jip31 — Thu, 12 Apr 2018 03:20:42 GMT

Re: How to agregate data from different sourcetypes?

DalJeanis — Thu, 12 Apr 2018 04:12:41 GMT

We formatted your code so it was easier to see the three queries. However, they were identical. Please update to add the second query.