Could you help me with a stats(sum) query?

[jip31]

hi

I use the code below in order to count some events from 3 fields:

(LogName SourceName Type )

index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats count by LogName SourceName Type | rename LogName as EventViewer_Source | sort  -count

Now I want to sum the different counts I have with the code above by LogName and by Type
I tried to do this but .....

index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats sum(count) as Total by LogName, Type

Thanks

[inventsekar]

not sure of this line - "Now I want to sum the differents counts i have with the code above by LogName and by Type"..
do you want to find out the difference between, the sum of counts by logname and by type?

[jip31]

No i want To count already done in the previous request by logname and type

[493669 · Accepted solution]

try this:

index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats count by LogName SourceName Type| eventstats sum(count) as total_count | rename LogName as EventViewer_Source | sort 0 -count

It will create new field as toal_count having sum of all count

[jip31]

it works thanks but the good result is in the column count and not in the column total_count
i want to count by logname and by type and not to count all the logname and type

[493669]

then remove | eventstats sum(count) as total_count from query

[jip31]

Thanks i Will test tomorrow