Hello,
I use the table count below :
index="wineventlog" sourcetype="wineventlog:*" SourceName="*" Type="Critique" | dedup host | table _time SourceName host | stats count by host | sort - count limit=10 | join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\x\\master\\WindowsVersion" | stats values(data) as OS by host] | table OS count
But in reality, i want not a count each time there is a new host but a global count of the OS
For example actually I have:
OS Count
W10 1
W10 1
But i need instead:
OS Count
W10 2
Could you help me please??
somebody for helping me please???
i have modified the code a few but always the same
index="windows" sourcetype="wineventlog:Application" SourceName="*" Type="Critique" OR Type="*" | dedup host | stats count by host |join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\x\\master\\WindowsVersion" |stats values(data) as OS by host]| table OS count| sort - count limit=10
ohhh i found!!
i have done this :
index="windows" sourcetype="wineventlog:Application" SourceName="*" Type="Critique" OR Type="*" | dedup host | stats count by host |join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\airbus\\master\\WindowsVersion" |stats values(data) as OS by host]| stats count values(host) by OS | table OS count| sort - count limit=10
The problem is you are counting by host, not by OS.
Try this
index="wineventlog" sourcetype="wineventlog:" SourceName="" Type="Critique" | dedup host | join host [search index=windows sourcetype=winregistry key_path="\registry\machine\software\wow6432node\x\master\WindowsVersion" | stats values(data) as OS by host] | stats count values(host) by OS | sort - count limit=10
I have no results with this code...