how to find all windows systems reporting a partcular event ID, Source, and/or Severity

[Justin_Grant]

What are the searches required to search across Windows Event Logs for:

• most recent events of a particular event ID and Source
• count of events of a particular event ID, per day for the past month
• all systems reporting a particular event ID and Source
• the most recent events of "error" severity across all my monitored systems

I realize this is an easy question, but it's one I heard from a Splunk user today and it didn't already have an entry in Answers...

[gkanapathy · Accepted solution]

This is really a basic search language issue, and might be better addressed in the http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/SearchCheatsheet or elsewhere in http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/WhatsInThisManual

Nevertheless:

• sourcetype=WinEventLog:* EventCode=$myeventcode$ Source=$mysource$ | head 5
• sourcetype=WinEventLog:* EventCode=$myeventcode$ earliest=-1mon | timechart span=1d count
• sourcetype=WinEventLog:* EventCode=$myeventcode$ Source=$mysource$ | top limit=0 host
• Severity=Error | dedup 1 host

The base search terms can of course be changed to suit the right WinEventLog, EventCode, Source, Severity, or other criteria. I'm pretty sure Severity isn't a field name, but I can't remember the right one.