topic Re: Advanced Search in Splunk Search

Advanced Search

hartfoml — Wed, 23 Nov 2011 21:35:04 GMT

I have a top ten search fpor windows Errors that I run each day.

My bose want to to know how many days each of the top ten have been on the top ten list

The report should look like this:

Event_ID | Num_Days_On_List | Count

256 | 5 | 256

1056 | 1 | 194

Re: Advanced Search

RicoSuave — Wed, 23 Nov 2011 22:11:51 GMT

This isn't exactly what you want, but i think it will get you close enough.

yoursearch | bucket _time span=1d as day | eval day=strftime(day, "%Y-%m-%d") | chart count over Event_ID by day

This should produce a nice table with the dates on the top. Then you can sort the counts by day by clicking on them. Run this search over a timeframe of at least 24 hours or greater. My security analysts love this search for security related events.

Re: Advanced Search

hartfoml — Wed, 23 Nov 2011 22:26:50 GMT

OH Ya this is good stuff. I like it but it is not realy what I'm lloking for here. I will be sure to keep this jem for later. Thanks much this is a great peace of code.

Re: Advanced Search

hartfoml — Wed, 23 Nov 2011 22:30:52 GMT

Matt,

Thanks for asking

I use something like this to get a tale with host ahd event ID for one day

"source="WinEventLog:*" Type="Error" | top host event_id | Table host event_id count"

Re: Advanced Search

hartfoml — Wed, 23 Nov 2011 22:34:21 GMT

I might have to put the results in a summary and then go back and get the count of days on the list from there or in a lookup table but I have never done that before.

Re: Advanced Search

eelisio2 — Mon, 28 Sep 2020 10:08:59 GMT

I think Summary Indexing would work for this.

Create a new index for your summary (e.g., summarytopstatus).

Create search to use the sitop command instead of top.
(sourcetype="yoursourcetype" | sitop Event_ID) with a relative timeframe of -1d@d

Edit the search to have it run on a scheduled basis. (every day at midnight)

Check 'Enable Summary Indexing'.
Select your new index.

The following should give your the results you are looking for:

index="summarytopstatus" search_name="yoursearchname" | stats count as Num_Days_On_List , sum(cvp*reserved*count) as TotalCount by Event_ID

Re: Advanced Search

MHibbin — Thu, 24 Nov 2011 11:57:41 GMT

Will this be run once a day? - Scheduled?

Re: Advanced Search

eelisio2 — Thu, 24 Nov 2011 13:30:25 GMT

Note the field in the sum() should be "cvp" underscore "reserved" underscore "count".

Re: Advanced Search

hartfoml — Mon, 28 Nov 2011 14:23:44 GMT

Yes I will start with once a day as the operations team meets every morning to disuse direction and progress