Getting Data In

Group similar Windows event IDs together with respect to time

amir_thales
Path Finder

Hello,

After several searches, I did not find the way to group my event ID together in relation to time.

That is, I want for each Id event to display the number of "count" on a week. Place the Event IDs horizontally and vertically the time (1 week) and for each crossing we have the total count of each eventID

Thank you
Amir

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| bin _time span=1w@w0
| chart count OVER _time BY EventID

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| bin _time span=1w@w0
| chart count OVER _time BY EventID
0 Karma

amir_thales
Path Finder

Hello @woodcock,

Thank you for you response.

Amir

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...