Here are the Fields & possible values.
Issue: When a (pc_error) event happens it doesn't report (pc_connection) which is reported in earlier event. (pc_id) reports all (3) fields.
search index=main (pc_id=* OR pc_connection=* OR pc_error="bluescreen")
| stats count eval(pc_error="bluescreen")) AS BlueScreened by pc_connection
Tried streamstats & filldown but no luck.
What is the best method to have (pc_error) stats with (pc_connection)?
Thanks in advance.
Assumptions:
1) There are connection events with pc_id and pc_connection.
2) There are error events with pc_id and pc_error.
3) You want all events where the pc_error value is "bluescreen" linked to the last known pc_connection for that pc_id. Then you want the results to be counted up, by pc_connection.
Try this...
index=main pc_id=* (pc_connection=* OR pc_error="bluescreen")
| rename COMMENT as "That should be all the events. Limit them to the fields we need, plus _time"
| fields pc_id pc_error pc_connection
| rename COMMENT as "Kill any mutant events that got through eith a pc_connection and a different pc_error"
| where pc_error="bluescreen" OR isnull(pc_error)
| rename COMMENT as "Sort and then copy pc_connection values forward across time, then kill pc_connection records"
| sort 0 pc_id _time
| streamstats last(pc_connection) as pc_connection by pc_id
| where isnotnull(pc_error)
| rename COMMENT as "Now we have only error records. Stats them up."
| stats count as BlueScreened values(pc_id) as pc_id by pc_connection
added pc_id to the results.
try this,
index=main pc_id=* OR pc_connection=* OR pc_error=bluescreen | stats count(pc_error) as bluescreened by pc_connection pc_id
This resulted in all bluescreened values to = 0.
Table appeared as
pc_connection | Pc_id | bluescreened
lan | 1234 | 0
All (3) events fields do show values and the result should be 46 for bluescreened.
What else can I try?