Need stats count per host and process_name

[deckard1984]

Right now a have a table list with fields populated where one process_name is repeating across multiples hosts with same EventID. 

index=main_sysmon sourcetype=xmlwineventlog process_exec=test EventCode=11 dest=hosts*
| strcat "Event ID: ", EventID " (" signature ")" timestampType
| strcat "EventDescription: " EventDescription " | TargetFilename: " TargetFilename " | User: " User activity 
| strcat EventDescription ": " TargetFilename " by " User details 
| eval attck = "N/A" 
| table Computer , UtcTime, timestampType, activity, Channel, attck, process_name

I want to have a total sum of counts per same host and process_name with all activity (or target file names listed under). For e.g

Computer | UTC | timestamp | activity     | process_name    | count       |
1                          | File list    | same - repeats  | missing value
2                          | File list    | same - repeats  | missing value

[deckard1984]

Grazie. 

I used:

| stats count latest(_time) AS _time values(*) as * by Computer

[gcusello]

Hi @deckard1984 ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @deckard1984 ,

do you know the stats command (https://docs.splunk.com/Documentation/SCS/current/SearchReference/StatsCommandOverview)?

index=main_sysmon sourcetype=xmlwineventlog process_exec=test EventCode=11 dest=hosts*
| strcat "Event ID: ", EventID " (" signature ")" timestampType
| strcat "EventDescription: " EventDescription " | TargetFilename: " TargetFilename " | User: " User activity 
| strcat EventDescription ": " TargetFilename " by " User details 
| eval attck = "N/A" 
| stats 
     count
     latest(_time) AS _time
     values(activity) AS activity
     BY Computer process_name

Ciao.

Giuseppe