Reporting

Building report with options

banderson7
Communicator

We've built a report for ~150 hosts and a big filtered list of the eventlogs. My fields are Host, EventCode, SourceName, sourcetype, Message & Count. Currently, I have a count of eventcodes per host, but it's been requested that I get a count of eventcodes of all the hosts, preferably in the same report.
Also, my message field is truncated to 75 characters. It's also been requested that the full message be readable as easily as possible. Below is my query:

(index=server OR index=lansweeper OR index=wineventlog OR index=windows OR index=adhoc_audit) tag::host=PHI (source="WinEventLog:System" OR source="WinEventLog:Security" OR source="WinEventLog:Application" OR source="WinEventLog:Directory Service" OR source=ls-winevent) SourceName!=TAAG.SchedulingService SourceName!=Paradigm.PCMS.Session SourceName!=W32Time SourceName!="ASP.NET*" SourceName!=".NET Runtime" SourceName!=Microsoft-Windows-WAS SourceName!=Paradigm.Vito.PCMS.Session SourceName!=LogSrcTraxCS.Message997I5 SourceName!=MSSQL$* SourceName!="Windows Update Agent" SourceName!="Phantom Call service" SourceName!=SQLISPackage100 EventCode!=592 EventCode!=593 EventCode!=562 EventCode!=567 EventCode!=540 EventCode!=564 EventCode!=538 EventCode!=594 EventCode!=600 EventCode!=560  SourceName!="Director Agent"  SourceName!=MR_MONITOR  EventCode!=18264  SourceName!="Microsoft-Windows-WMI"  SourceName!=vmStatsProvider  SourceName!=".NET Runtime 2.0 Error Reporting"  EventCode!=6013  EventCode!=4634  SourceName!="Microsoft-Windows-Kernel-General"  SourceName!=SQLISPackage  EventCode!=7036 | eval Message=substr(Message,1,75)             | stats  count(EventCode) as COUNT by host, EventCode,SourceName,sourcetype, Message             | sort  + COUNT

So, I'm thinking it would look something like EventCode Count, then expanding the eventcode would give me a list of hosts and their count. Is this possible in Splunk?

0 Karma

woodcock
Esteemed Legend

Swap this:

.... | stats  count(EventCode) as COUNT by host, EventCode,SourceName,sourcetype, Message | sort  + COUNT

for this:

... | top limit=0 EventCode by host | addtotals col=t row=f labelfield=host label="TOTAL"
0 Karma

banderson7
Communicator

That gave me host,eventcode,count,percent fields, and I'm uncertain what the percentage ... is a percentage of.

0 Karma

banderson7
Communicator

Looks like I need to get off my nethers and learn to work w/ Pivot tables.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...