Hi Answers, hopefully someone can help me figure this out.
I need to see a list of all results and a distinct count of all programs running for each host, and specifically which computers,users are running a specific program e.g logon.exe
Example data:
host=computer1 user=joe,user program=Logon.exe
host=computer1 user=joe,user program=word.exe
host=computer1 user=joe,user program=notepad.exe
host=computer2 user=jane,user program=outlook.exe
host=computer2 user=jane,user program=lotus.exe
host=computer2 user=jane,user program=notepad.exe
host=computer3 user=dave,user program=outlook.exe
host=computer3 user=dave,user program=lotus.exe
host=computer3 user=dave,user program=notepad.exe
Expected results,
computer_name user, count_of_running_programs count_of_logon.exe
I think you can do this without a subsearch. Try index=foo | stats dc(program) as programCount, dc(eval(program="Logon.exe")) as logonCount by host, user | table host user programCount logonCount
.
I think you can do this without a subsearch. Try index=foo | stats dc(program) as programCount, dc(eval(program="Logon.exe")) as logonCount by host, user | table host user programCount logonCount
.
Perfect! Thank you.
Bonus points.. if you can help me identify users logged into multiple computers.. Bonus Bonus points if I can display both computes in a multi-value field as a result of the stats command.
Bonus points:
index=foo | stats dc(program) as programCount, dc(eval(program="Logon.exe")) as logonCount by host, user | table host user programCount logonCount | eventstats values(hosts) AS hosts by user