Can you help me with my table count?

[jip31]

Hello,

I use the table count below :

index="wineventlog" sourcetype="wineventlog:*" SourceName="*" Type="Critique" | dedup host  | table  _time SourceName host  | stats count by host  | sort - count limit=10 | join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\x\\master\\WindowsVersion" | stats values(data) as OS by host] | table OS count

But in reality, i want not a count each time there is a new host but a global count of the OS

For example actually I have:

OS Count
W10 1
W10 1

But i need instead:

OS Count
W10 2

Could you help me please??

[jip31]

somebody for helping me please???

[jip31]

i have modified the code a few but always the same

index="windows" sourcetype="wineventlog:Application" SourceName="*" Type="Critique" OR Type="*" | dedup host   | stats count by host   |join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\x\\master\\WindowsVersion" |stats values(data) as OS by host]| table OS count| sort - count limit=10

[jip31]

ohhh i found!!
i have done this :

index="windows" sourcetype="wineventlog:Application" SourceName="*" Type="Critique" OR Type="*" | dedup host   | stats count by host   |join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\airbus\\master\\WindowsVersion" |stats values(data) as OS by host]| stats count values(host) by OS | table OS count| sort - count limit=10

[osakachan]

The problem is you are counting by host, not by OS.

Try this
index="wineventlog" sourcetype="wineventlog:" SourceName="" Type="Critique" | dedup host | join host [search index=windows sourcetype=winregistry key_path="\registry\machine\software\wow6432node\x\master\WindowsVersion" | stats values(data) as OS by host] | stats count values(host) by OS | sort - count limit=10

[jip31]

I have no results with this code...