hi
I use the code below in order to count some events from 3 fields:
(LogName SourceName Type )
index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats count by LogName SourceName Type | rename LogName as EventViewer_Source | sort -count
Now I want to sum the different counts I have with the code above by LogName and by Type
I tried to do this but .....
index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats sum(count) as Total by LogName, Type
Thanks
try this:
index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats count by LogName SourceName Type| eventstats sum(count) as total_count | rename LogName as EventViewer_Source | sort 0 -count
It will create new field as toal_count having sum of all count
not sure of this line - "Now I want to sum the differents counts i have with the code above by LogName and by Type"..
do you want to find out the difference between, the sum of counts by logname and by type?
No i want To count already done in the previous request by logname and type
try this:
index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats count by LogName SourceName Type| eventstats sum(count) as total_count | rename LogName as EventViewer_Source | sort 0 -count
It will create new field as toal_count having sum of all count
it works thanks but the good result is in the column count and not in the column total_count
i want to count by logname and by type and not to count all the logname and type
then remove | eventstats sum(count) as total_count from query
Thanks i Will test tomorrow