Subsearch on results

[omgwut56k]

Hi Answers, hopefully someone can help me figure this out.

I need to see a list of all results and a distinct count of all programs running for each host, and specifically which computers,users are running a specific program e.g logon.exe

Example data:

host=computer1 user=joe,user program=Logon.exe
host=computer1 user=joe,user program=word.exe
host=computer1 user=joe,user program=notepad.exe

host=computer2 user=jane,user program=outlook.exe
host=computer2 user=jane,user program=lotus.exe
host=computer2 user=jane,user program=notepad.exe

host=computer3 user=dave,user program=outlook.exe
host=computer3 user=dave,user program=lotus.exe
host=computer3 user=dave,user program=notepad.exe

Expected results,
computer_name user, count_of_running_programs count_of_logon.exe

[richgalloway · Accepted solution]

I think you can do this without a subsearch. Try index=foo | stats dc(program) as programCount, dc(eval(program="Logon.exe")) as logonCount by host, user | table host user programCount logonCount.

[omgwut56k]

Perfect! Thank you.

[omgwut56k]

Bonus points.. if you can help me identify users logged into multiple computers.. Bonus Bonus points if I can display both computes in a multi-value field as a result of the stats command.

[woodcock]

Bonus points:

index=foo | stats dc(program) as programCount, dc(eval(program="Logon.exe")) as logonCount by host, user | table host user programCount logonCount | eventstats values(hosts) AS hosts by user