Splunk Search

include date in request - stats count

numeroinconnu12
Path Finder

Hello,
I have a problem.
This is my request, it works well.

    index=wineventlog EventID=4624 host=wipr625a OR host=wipr625b OR host=wipr626a OR host=wipr626b user!="DWM*"
   | stats count as "nombre de connexions" by user, host, name

I would like to include the date in my results and that's how I modified my request, only with that request my results are wrong, did I forget something?

 index=wineventlog EventID=4624 host=wipr625a OR host=wipr625b OR host=wipr626a OR host=wipr626b user!="DWM*"
| eval date=strftime(_time, "%d/%m/%Y %H:%M")
| stats count as "nombre de connexions" by user, date, host, name

thanks !

0 Karma

HiroshiSatoh
Champion

The search statement is correct. Please tell us specifically about the problem.

0 Karma

HiroshiSatoh
Champion

Is the problem that the number of results is different?
Did you check the displayed error?

https://answers.splunk.com/answers/506621/unknown-error-for-peer-xxx-search-results-might-be.html

How about the following search statement?

| bin span=1m _time
| stats count as "nombre de connexions" by user, _time, host, name
0 Karma

numeroinconnu12
Path Finder

Hello @HiroshiSatoh ,

see my results without date :

alt text

and my results when i include date : alt text

Do you see the difference?

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...