Splunk Search

Can you help me with my table count?

jip31
Motivator

Hello,

I use the table count below :

index="wineventlog" sourcetype="wineventlog:*" SourceName="*" Type="Critique" | dedup host  | table  _time SourceName host  | stats count by host  | sort - count limit=10 | join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\x\\master\\WindowsVersion" | stats values(data) as OS by host] | table OS count

But in reality, i want not a count each time there is a new host but a global count of the OS

For example actually I have:

OS Count
W10 1
W10 1

But i need instead:

OS Count
W10 2

Could you help me please??

Tags (2)
0 Karma

jip31
Motivator

somebody for helping me please???

0 Karma

jip31
Motivator

i have modified the code a few but always the same

index="windows" sourcetype="wineventlog:Application" SourceName="*" Type="Critique" OR Type="*" | dedup host   | stats count by host   |join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\x\\master\\WindowsVersion" |stats values(data) as OS by host]| table OS count| sort - count limit=10
0 Karma

jip31
Motivator

ohhh i found!!
i have done this :

index="windows" sourcetype="wineventlog:Application" SourceName="*" Type="Critique" OR Type="*" | dedup host   | stats count by host   |join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\airbus\\master\\WindowsVersion" |stats values(data) as OS by host]| stats count values(host) by OS | table OS count| sort - count limit=10
0 Karma

osakachan
Communicator

The problem is you are counting by host, not by OS.

Try this
index="wineventlog" sourcetype="wineventlog:" SourceName="" Type="Critique" | dedup host | join host [search index=windows sourcetype=winregistry key_path="\registry\machine\software\wow6432node\x\master\WindowsVersion" | stats values(data) as OS by host] | stats count values(host) by OS | sort - count limit=10

0 Karma

jip31
Motivator

I have no results with this code...

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...