topic Re: log sources in Getting Data In

log sources

pradeep577 — Fri, 01 Jun 2018 13:24:17 GMT

Hi,

I have been ask to generate report for top log sources which is generating lot of traffic. I need help to generate report as

< sourcetype>

Can someone from group help me in this. Currently Im using

| metadata type=sources | where
totalCount>0 | table source totalCount

where i get source & total count but Iam looking for < sourcetype> format.

Thanks in advance.

Re: log sources

niketn — Fri, 01 Jun 2018 13:29:12 GMT

Try the following:

| metadata type=sourcetypes index="<yourIndexName>"
| search totalCount>0
| table sourcetype totalCount

Re: log sources

pradeep577 — Fri, 01 Jun 2018 13:48:00 GMT

Hi,

Thnk you for quick reply.
I executed this query

| metadata type=sourcetypes index="wineventlog"
| search totalCount>0
| table source totalCount

Output is:

Source: blank(empty)
Total count : numbers

Re: log sources

FrankVl — Fri, 01 Jun 2018 13:50:17 GMT

If you get the data by sourcetype, you of course also need to table the sourcetype field, not the source field 🙂

Re: log sources

pradeep577 — Fri, 01 Jun 2018 13:56:20 GMT

Still same please see attached screenshot

It doesnt give me which logs are contributing to high license usage?

Re: log sources

FrankVl — Sat, 02 Jun 2018 00:53:19 GMT

| metadata type=sourcetypes doesn’t return a source field, only sourcetype and count and some time stamps (run it without the table command to see the full output).

If you want to count just by sourcetype, just change your table command to show the sourcetype field instead of the source field.

If you want to count by sourcetype and source, metadata command is not your friend. Try this in stead:

| tstats count where index = yourindex by source,sourcetype

Re: log sources

FrankVl — Sat, 02 Jun 2018 00:55:12 GMT

Think you’ve caused a bit of confusion by tabling the nonexistent source field 😉

Re: log sources

niketn — Sat, 02 Jun 2018 04:50:35 GMT

@FrankVI, thanks for catching that. I have made the correction!