Reporting

How to extract some sourcename of a report?

jip31jip31
Explorer

hi,
I use this report request but I would like some sourcenames to not appear in the result.
Their name is:

Microsoft-Windows-Sysmon

Microsoft-Windows-TaskScheduler
PowerShell
MacAFee Endpoint Security

Thanks for your help

index="*" sourcetype="wineventlog:*" EventCode=* Type="*" | stats count by SourceName Type
0 Karma
1 Solution

kmaron
Motivator
index="" sourcetype="wineventlog:" EventCode= Type="" | stats count by SourceName Type | fields - SourceName

You can remove a field from your result using the fields command and a minus

View solution in original post

0 Karma

kmaron
Motivator

specify which sourcenames you do not want in the initial search:

index="*" sourcetype="wineventlog:*" EventCode=* Type="*" SourceName!="Microsoft-Windows-Sysmon" SourceName!="Microsoft-Windows-TaskScheduler" SourceName!="PowerShell" SourceName!="MacAFee Endpoint Security" | stats count by SourceName Type

or to simplify it

index="*" sourcetype="wineventlog:*" EventCode=* Type="*" NOT SourceName IN ("Microsoft-Windows-Sysmon" "Microsoft-Windows-TaskScheduler" "PowerShell" "MacAFee Endpoint Security") | stats count by SourceName Type
0 Karma

kmaron
Motivator
index="" sourcetype="wineventlog:" EventCode= Type="" | stats count by SourceName Type | fields - SourceName

You can remove a field from your result using the fields command and a minus

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!