All,
I have about 4k hosts collecting PS data. What I would like to do is get a dashboard or alert when the PID for SSHD changes. I really have no idea how to compare that many collections to their previous ones like that.
I got this far...
sourcetype=ps COMMAND=sshd PID=*
I'd try something like this:
| stats values(PID) AS PIDs dc(PID) AS PID_count by host
| where PID_count > 1
Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂
I'd try something like this:
| stats values(PID) AS PIDs dc(PID) AS PID_count by host
| where PID_count > 1
Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂