I would like to report only on specific eventtypes.
I have a search that returns the eventtypes that i want to chart vs. each other (firewall-accept vs firewall-deny). But I also have a number of other eventtypes that apply to this data that also show up in this search (eventtype=cisco_firewall)
How can I only show the two eventtypes that I care about in the timechart (accept vs deny)
Your search could either look something like:
(eventtype="firewall-accept" OR eventtype="firewall-deny") other search terms | timechart count by eventtype
or it could filter to the eventtypes
... | eval a=mvfilter(eventtype == "firewall-accept" or eventtype == "firewall-deny") | search a=* | timechart count by a
The first would probably be the cleanest way, if you're able to use either method.
Neither 2 options worked for me in version 6.x.x. Interesting. I went back and disabled the one eventtype, I needed removed in my dashboard.
Your search could either look something like:
(eventtype="firewall-accept" OR eventtype="firewall-deny") other search terms | timechart count by eventtype
or it could filter to the eventtypes
... | eval a=mvfilter(eventtype == "firewall-accept" or eventtype == "firewall-deny") | search a=* | timechart count by a
The first would probably be the cleanest way, if you're able to use either method.
Second option solved my problem as well! Thanks!
I had this same problem and the second option was perfect. Thank you!
The second query works like a charm, thanks