topic Re: Can you help me with the following stats data query? in Splunk Search

Can you help me with the following stats data query?

jip31 — Fri, 19 Oct 2018 13:48:31 GMT

Hello,

I use the request below

index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | eval time = strftime(_time, "%m/%d/%Y %H:%M")  | dedup time | sort -time | table time host Type EventCode Message

I try to do a count by type and by time, but for time, i just need to take into account the month.

I need the same things but by type, by host, and by month.

could you help me please???

Re: Can you help me with the following stats data query?

renjith_nair — Fri, 19 Oct 2018 14:07:56 GMT

@jip31,
Try extracting the month(with year)and do the stats

index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | eval time = strftime(_time, "%m/%d/%Y %H:%M")  | dedup time | sort -time | eval mon=strftime(_time,"%Y-%m")|stats count by mon,type

Also, if you are using dedup by time , then it deletes all duplicates just based on time and might affect your count

Re: Can you help me with the following stats data query?

3no — Fri, 19 Oct 2018 14:10:18 GMT

I'm not sure to understand your request, but I think it should look like someting like that :

index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | timechart span=1month count by Type

Is that what you're looking for ?

Re: Can you help me with the following stats data query?

Vijeta — Sun, 21 Oct 2018 20:29:48 GMT

Try this-

index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | bin span=1mon  _time| stats count values(Message) values(EventCode) by Type host _time

Re: Can you help me with the following stats data query?

jip31 — Mon, 22 Oct 2018 05:32:47 GMT

Hi i have no result with your query even if when i do index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | i have results

Re: Can you help me with the following stats data query?

jip31 — Mon, 22 Oct 2018 05:50:06 GMT

hi its close of want i want but there is mistake in the count
on my computer i have :
- october : 3 Avertissement with EventCode 51
- September : 2 Avertissement with EventCode 51 and 4 Erreurs with EventCode 11
So i have 9 events
In your count i have for example 386 Avertissements with EventCode 51 in September!

Re: Can you help me with the following stats data query?

Vijeta — Mon, 22 Oct 2018 05:54:25 GMT

@jip31 If you want to do the count by Eventcode then try the below code

index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | bin span=1mon  _time| stats count values(Message)  by EventCode Type host _time

Re: Can you help me with the following stats data query?

jip31 — Mon, 22 Oct 2018 07:21:23 GMT

Yes but my main problem is the count which is false
when i look my events i have a lot of events which the same time
for example : 10/04/2018 05:44:47 AM
due to this piece of code bin span=1mon _time i cant do a dedup time
have you an idea please??

Re: Can you help me with the following stats data query?

renjith_nair — Mon, 22 Oct 2018 11:05:05 GMT

@jip31,
are you getting results after eval mon=strftime(_time,"%Y-%m") and also change type to Type

Re: Can you help me with the following stats data query?

jip31 — Mon, 22 Oct 2018 11:49:44 GMT

yes it was due to Type renjith, many thanks

Re: Can you help me with the following stats data query?

landen99 — Mon, 22 Oct 2018 12:18:04 GMT

To remove duplicates on time and count by eventcode:

index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | dedup _time | bin span=1mon  _time| stats count values(Message)  by EventCode Type host _time

If the field date_month is available, you could use that instead of _time, if you wished.