Difference between Queries ??

Vishal2 — Thu, 29 Jul 2021 06:27:44 GMT

I have 2 search Queries to get the windows shutdown list from the lookup file but when I run these 2 Queries I am getting different host list for same time period, Can you please suggest the best Query to get the shutdown hosts from the lookup file.

1. index=* host=* sourcetype=XmlWinEventLog* (EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008) join type=inner host [ |inputlookup Windows.csv ] | stats count by host | dedup host

2. index=* sourcetype=XmlWinEventLog* EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008 [ | inputlookup Windows.csv | return 1000 host] | stats count by host | where count >1

Re: Difference between Queries ??

kamlesh_vaghela — Thu, 29 Jul 2021 06:45:32 GMT

@Vishal2

In this case I will suggest this search,

index=* sourcetype=XmlWinEventLog* (EventCode=41 OR EventCode=1074 OR EventCode=6006 OR EventCode=6008) [| inputlookup Windows.csv | return 1000 host] | stats count by host | where count >1

and if I'm right you will have only those host which has events if you remove "| where count >1" from search.

topic Re: Difference between Queries ?? in Alerting

Difference between Queries ??

Re: Difference between Queries ??