I'm trying to run -
| tstats count where index=wineventlog* TERM(EventID=4688) by _time span=1m
It returns no results but specifying just the term's value seems to work -
| tstats count where index=wineventlog* TERM(4624) by _time span=1m
https://conf.splunk.com/files/2020/slides/PLA1089C.pdf explains the subject well but my simple query is not working.
Hi @danielbb ,
It's EventCode, not EventID. 😉
| tstats count where index=wineventlog* TERM(EventCode=4688) by _time span=1m
best regards,
Andreas
Hi danielbb,
You can try
| tstats count where index=wineventlog* TERM(EventID=*) by _time span=1m
But in the _raw event, you must have something which corresponds, like
...EventID=4624...
Then, if you want to use this EventID in the group by, you can try (be carefull The text you provide for the PREFIX() directive must be in lower case)
| tstats count where index=wineventlog* TERM(EventID=*) by PREFIX(eventid=) _time span=1m
Regards
This is perfect.
Ok, but TERM(4624) does work.
Which means that term is stored in a tsidx file (is indexed).
The tstats command only works with indexed fields, which usually does not include EventID.