Hey There Folks,
Im looking at a way to measure a decrease in logging levels by host and eventcode. Ive setup the below query which is fine from a static perspective but very much looking to try and identify that scenario where lets say we see a 50% log drop off in a specific eventcode in the past 24 hour period.
index=wineventlog sourcetype=WinEventLog EventCode=4625
| fields EventCode, host
| stats dc(host) as num_unique_hosts
| where num_unique_hosts < 500
Is there an easy way to convert this over?
Thanks Kindly,
Tom
