Splunk Search

include date in request - stats count

numeroinconnu12
Path Finder

Hello,
I have a problem.
This is my request, it works well.

    index=wineventlog EventID=4624 host=wipr625a OR host=wipr625b OR host=wipr626a OR host=wipr626b user!="DWM*"
   | stats count as "nombre de connexions" by user, host, name

I would like to include the date in my results and that's how I modified my request, only with that request my results are wrong, did I forget something?

 index=wineventlog EventID=4624 host=wipr625a OR host=wipr625b OR host=wipr626a OR host=wipr626b user!="DWM*"
| eval date=strftime(_time, "%d/%m/%Y %H:%M")
| stats count as "nombre de connexions" by user, date, host, name

thanks !

0 Karma

HiroshiSatoh
Champion

The search statement is correct. Please tell us specifically about the problem.

0 Karma

HiroshiSatoh
Champion

Is the problem that the number of results is different?
Did you check the displayed error?

https://answers.splunk.com/answers/506621/unknown-error-for-peer-xxx-search-results-might-be.html

How about the following search statement?

| bin span=1m _time
| stats count as "nombre de connexions" by user, _time, host, name
0 Karma

numeroinconnu12
Path Finder

Hello @HiroshiSatoh ,

see my results without date :

alt text

and my results when i include date : alt text

Do you see the difference?

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...