Here are the Fields & possible values.
Issue: When a (pcerror) event happens it doesn't report (pcconnection) which is reported in earlier event. (pc_id) reports all (3) fields.
search index=main (pcid=* OR pcconnection=* OR pcerror="bluescreen")
| stats count eval(pcerror="bluescreen")) AS BlueScreened by pc_connection
Tried streamstats & filldown but no luck.
What is the best method to have (pcerror) stats with (pcconnection)?
Thanks in advance.
index=main pcid=* OR pcconnection=* OR pcerror=bluescreen | stats count(pcerror) as bluescreened by pcconnection pcid
This resulted in all bluescreened values to = 0.
Table appeared as
pcconnection | Pcid | bluescreened
lan | 1234 | 0
All (3) events fields do show values and the result should be 46 for bluescreened.
What else can I try?
1) There are connection events with pcid and pcconnection.
2) There are error events with pcid and pcerror.
3) You want all events where the pcerror value is "bluescreen" linked to the last known pcconnection for that pcid. Then you want the results to be counted up, by pcconnection.
index=main pc_id=* (pc_connection=* OR pc_error="bluescreen") | rename COMMENT as "That should be all the events. Limit them to the fields we need, plus _time" | fields pc_id pc_error pc_connection | rename COMMENT as "Kill any mutant events that got through eith a pc_connection and a different pc_error" | where pc_error="bluescreen" OR isnull(pc_error) | rename COMMENT as "Sort and then copy pc_connection values forward across time, then kill pc_connection records" | sort 0 pc_id _time | streamstats last(pc_connection) as pc_connection by pc_id | where isnotnull(pc_error) | rename COMMENT as "Now we have only error records. Stats them up." | stats count as BlueScreened values(pc_id) as pc_id by pc_connection
added pc_id to the results.