Splunk Search
Highlighted

Can you help me with my stats count?

Contributor

hello

I use the request below, which works:

index="windows" sourcetype="wineventlog:Application" "SourceName=*" Type="Critique" OR Type="Avertissement"
| dedup _time SourceName 
| table  _time SourceName |
 stats count by SourceName 
| rename SourceName as Application count as Erreurs 
| sort - Erreurs limit=10

I try to do the count also by host
so i do this :

index="windows" sourcetype="wineventlog:Application" "SourceName=*" Type="Critique" OR Type="Avertissement"
| dedup _time SourceName 
| table  _time SourceName |
 stats count by SourceName host
| rename SourceName as Application count as Erreurs 
| sort - Erreurs limit=10

but it doesn't work.

could you help me?

0 Karma
Highlighted

Re: Can you help me with my stats count?

Communicator

Hello @jip31,

First of all, you do not need to do dedup if you will do a stats count, you will have the same result and stats count is faster.
Table is only aesthetic, so you do not need to do it at first, or maybe use fields, to have a faster query, but I think it will not be necessary.
And, ah! You had a typo with the field Source name!

Try this query:
index="windows" sourcetype="wineventlog:Application" SourceName=* Type="Critique" OR Type="Avertissement"
| stats count by SourceName host
| rename SourceName as Application count as Erreurs
| sort - Erreurs limit=10

0 Karma
Highlighted

Re: Can you help me with my stats count?

SplunkTrust
SplunkTrust

The reason second search doesn't work because your table command (line 3) restricts the fields in result to _time and SourceName only. There is not host field after that table command, thus next stats doesn't work.

You can try something like this

index="windows" sourcetype="wineventlog:Application" "SourceName=*" Type="Critique" OR Type="Avertissement"
| stats dc(_time) as Erreurs by SourceName host
| rename SourceName as Application
 | sort - Erreurs limit=10

View solution in original post

0 Karma
Highlighted

Re: Can you help me with my stats count?

Contributor

Hey,

You can also use the top function like that :

index="windows" sourcetype="wineventlog:Application" "SourceName=*" Type="Critique" OR Type="Avertissement"
| top 10 SourceName,host

That should return you the same result than the =search you were writing.

KailA

0 Karma
Highlighted

Re: Can you help me with my stats count?

Contributor

many thanks for all your perfect answer

0 Karma