Can you help me with the following stats data query?

[jip31]

Hello,

I use the request below

index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | eval time = strftime(_time, "%m/%d/%Y %H:%M")  | dedup time | sort -time | table time host Type EventCode Message

I try to do a count by type and by time, but for time, i just need to take into account the month.

I need the same things but by type, by host, and by month.

could you help me please???

[landen99]

To remove duplicates on time and count by eventcode:

index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | dedup _time | bin span=1mon  _time| stats count values(Message)  by EventCode Type host _time

If the field date_month is available, you could use that instead of _time, if you wished.

[Vijeta]

Try this-

index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | bin span=1mon  _time| stats count values(Message) values(EventCode) by Type host _time

[jip31]

hi its close of want i want but there is mistake in the count
on my computer i have :
- october : 3 Avertissement with EventCode 51
- September : 2 Avertissement with EventCode 51 and 4 Erreurs with EventCode 11
So i have 9 events
In your count i have for example 386 Avertissements with EventCode 51 in September!

[jip31]

Yes but my main problem is the count which is false
when i look my events i have a lot of events which the same time
for example : 10/04/2018 05:44:47 AM
due to this piece of code bin span=1mon _time i cant do a dedup time
have you an idea please??

[Vijeta]

@jip31 If you want to do the count by Eventcode then try the below code

index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | bin span=1mon  _time| stats count values(Message)  by EventCode Type host _time

[3no]

I'm not sure to understand your request, but I think it should look like someting like that :

index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | timechart span=1month count by Type 

Is that what you're looking for ?

[renjith_nair · Accepted solution]

@jip31,
Try extracting the month(with year)and do the stats

index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | eval time = strftime(_time, "%m/%d/%Y %H:%M")  | dedup time | sort -time | eval mon=strftime(_time,"%Y-%m")|stats count by mon,type

Also, if you are using dedup by time , then it deletes all duplicates just based on time and might affect your count

[jip31]

Hi i have no result with your query even if when i do index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | i have results

[renjith_nair]

@jip31,
are you getting results after eval mon=strftime(_time,"%Y-%m") and also change type to Type

[jip31]

yes it was due to Type renjith, many thanks