Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to edit my search to display individual ev...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have the following search and it works pretty well, however I need to see the event counts for each of the sourcetypes individually not as total count.
index=windows (splunk_server=* OR splunk_server=*) OR (sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:Application" OR sourcetype="WinEventLog:System") | chart count values(sourcetype) as index by splunk_server | table splunk_server index count | rename splunk_server TO abc-host | rename index TO Log-Type
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I understood the original intention of you search filter, using tstats will be faster.
| tstats count where index=windows OR (sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:Application" OR sourcetype="WinEventLog:System") by index sourcetype splunk_server
| table sourcetype splunk_server index count
| rename splunk_server TO abc-host
| rename index TO Log-Type
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I understood the original intention of you search filter, using tstats will be faster.
| tstats count where index=windows OR (sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:Application" OR sourcetype="WinEventLog:System") by index sourcetype splunk_server
| table sourcetype splunk_server index count
| rename splunk_server TO abc-host
| rename index TO Log-Type
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes, it did thank you, had to re-arrange some things
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad to hear it was straightened out.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
not exactly ----the query gives me a total count of for all of the sources combined , I would like to see totals of each individually
total :135014
MSAD:NT6:DNS-Health
MSAD:NT6:DNS-Zone-Information
MSAD:NT6:Health
MSAD:NT6:Netlogon
MSAD:NT6:Replication
MSAD:NT6:SiteInfo
WinEventLog:DNS-Server
WinEventLog:Directory-Service
WindowsUpdateLog
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think I am missing something. The query I provided should give you a table with the total count of events per index, sourcetype, and server. For example, here is my own data using my query (I MD5'ed my host field). If this was your data, what field am I missing or what is out of place, because your last response does not clarify the request for me. Sorry.
sourcetype abc-host Log-Type count
WinEventLog:Application f6a667... wineventlog 140
WinEventLog:Security f6a667... wineventlog 169
WinEventLog:System f6a667... wineventlog 611
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@bluemarvel, did my answer give you what you needed?
Building Reliable Asset and Identity Frameworks in Splunk ES
Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting
Automatic Discovery Part 3: Practical Use Cases
