Getting Data In

Group similar Windows event IDs together with respect to time

amir_thales
Path Finder

Hello,

After several searches, I did not find the way to group my event ID together in relation to time.

That is, I want for each Id event to display the number of "count" on a week. Place the Event IDs horizontally and vertically the time (1 week) and for each crossing we have the total count of each eventID

Thank you
Amir

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| bin _time span=1w@w0
| chart count OVER _time BY EventID

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| bin _time span=1w@w0
| chart count OVER _time BY EventID
0 Karma

amir_thales
Path Finder

Hello @woodcock,

Thank you for you response.

Amir

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...