I'm attempting to write a search using eventcount command. I want to graph the number of events in my index/sourcetype per day over a span of 1 week. Can I use the eventcount for this? I'm not h...
Want to count all events from specific indexes say abc, pqr and xyz only for span of 1h using tstats and present it in timechart. Tried this but now working | tstats count WHERE earliest=-1d...
...ondition on tstats removed for the example below):
| tstats latest(_time) as latest where index=* by index
returns 51 of my indexes, while:
| eventcount summarize=false index=* | dedup i...
Hi,
is it possible to a add field to each event and add a value to this field, that shows the chronological count of the specific event per user? Let's call this field "eventserial".
So that th...
...otal Eventcount and sparkline for count of 1month
As per the above query i am getting result like this
Is there any other alternative for this please suggest?
Hi.
A site we are on has attemtped to migrate data from one splunk cluster to another. We've come in late to help and have fixed most things up but they are noticing a difference in their eventcount...
I am comparing the results of the following two searches for one user id:
source="xxxx" | transaction user_id, pid keeporphans=f maxspan=70m maxpause=45m mvraw=t delim="," mvlist=t | stats avg(eventcount...
...nto problems with structuring the query correctly. I wrote two queries that I need to combine:
| eventcount summarize=false index=* | fields index | dedup index which gives me all of the indexes t...
...et back the proper results with dispatchState: DONE and eventCount: 0 but I know for sure that there are results because I also tried running the same query from the Splunk UI and I do get results back....