My base search works great for a 12 hour search
sourcetype="logs" | timechart count as eventcount by host useother = f
I've tried several variations on just getting the top couple using Top
per | top count by host
but nogo.
Would there be an easy way to say if an any hour exceeds 100 events then show the entire
12 hours for those hosts?
Even just showing where events hit over 100 for an hour for any host would be very helpful.
To do the search by hour just use the bucket command.
<your search> | bucket _time span=1h | timechart count as mycount
This will give you a table with values by host greater than 100
<your search> | bucket _time span=1h | stats count as mycount by host,_time | where mycount > 100
Close. My fault for not being more specific.
I'm trying to timechart out hosts that have event counts > 100.
Seems like I should be closer with the below.
Or is there a way to chart any host for the whole 12 hours if it gets 1 hour over 100?
Always an illegal search due to permissions or invalid arguement.
I'll keep tinkering- feel like Im closer- not quite there yet though.
I appreciate the help!