Here is my search:
index=windows source="WMI:Services" State=Stopped StartMode=Auto | rex field=_raw "\nName=(?PIBM.{1,})" | chart count by SvcName | rename SvcName as "Service Name"
And I need to add another column to the right of the "Service Name" column called "Host". This way I have the windows service name associated with the host that I'm looking for.
How do I adjust my search string to add this column to the statistics table view?
Thanks!
I think you just need.
index=windows source="WMI:Services" State=Stopped StartMode=Auto | rex field=_raw "nName=(?PIBM.{1,})" | stats count by SvcName host | rename SvcName as "Service Name"
I think you just need.
index=windows source="WMI:Services" State=Stopped StartMode=Auto | rex field=_raw "nName=(?PIBM.{1,})" | stats count by SvcName host | rename SvcName as "Service Name"
Thank you so much! That works perfectly! Apparently I'm a total noob when it comes to tabl'ing out my results. 😉
no worries. Here's a link to give you some insight into the difference between the stats and chart commands - http://answers.splunk.com/answers/32001/difference-stats-and-chart.html