Hi there, hoping this is a quick question:
I've got a search which polls for several eventlog types, and I want to put them into a table by eventtype using number of hosts in each eventtype, r...
Hello. I am trying to get interactive logon logs for all workstations in an organization. The event code for this log is 4624 with the EventType 2. I am only seeing EventType 0 in Splunk when I d...
I'm trying to extract a report for devices in my network. Home assistant sends a log record with a value of 1 when a device is present and 0 when it's not, but sometimes it loses the record of the de...
Hi, I have a stat on eventtype like this index=xyz | stats count by eventtype This query generates: All_logs = 14 Error = 2 Login = 4 Auth = 8 Where All_logs is also an eventtype w...
This is my search I am trying to use in an eventtype so I can tag my events.
index = mail
| eval Subject=coalesce(Subject,subjectx)
| search
Subject = "*NVEM Battery Alert*"
But i get t...
Hi, is it not possible to use a regex to determine an eventtype. I would like to usee something like:
\d{4}-\d{1,2}-\d{1,2}T\d{2}:\d{2}:\d{2}.\d{3}. \| [A-Z]+ \|
to classify events.
I have a dashboard displaying counts on some eventtypes I have created. I tried to optimize by adding a base search to my dashboard but it seems that eventtypes are not available in the results o...
I have loaded logs and can do the following search:
index=cms_cc_logs error
This returns 239 events.
If I do the below:
index=cms_cc_logs error |Typelearner
I get 6 suggestions....