I'm attempting to write a search using eventcount command. I want to graph the number of events in my index/sourcetype per day over a span of 1 week. Can I use the eventcount for this? I'm not h...
Want to count all events from specific indexes say abc, pqr and xyz only for span of 1h using tstats and present it in timechart. Tried this but now working | tstats count WHERE earliest=-1d...
...ondition on tstats removed for the example below):
| tstats latest(_time) as latest where index=* by index
returns 51 of my indexes, while:
| eventcount summarize=false index=* | dedup i...
Hi,
is it possible to a add field to each event and add a value to this field, that shows the chronological count of the specific event per user? Let's call this field "eventserial".
So that th...
Hi.
A site we are on has attemtped to migrate data from one splunk cluster to another. We've come in late to help and have fixed most things up but they are noticing a difference in their eventcount...
I am comparing the results of the following two searches for one user id:
source="xxxx" | transaction user_id, pid keeporphans=f maxspan=70m maxpause=45m mvraw=t delim="," mvlist=t | stats avg(eventcount...
...nto problems with structuring the query correctly. I wrote two queries that I need to combine:
| eventcount summarize=false index=* | fields index | dedup index which gives me all of the indexes t...
Hi everyone,
I have a couple questions about using the eventcount command...
1.) I noticed that if you set summarize=false, the event count results will be split by index and search peer. Is t...
I did a dashboard panel that shows stats count results with a pie chart.
I'd like to show in the panel title the total number of events (not the result number).
I already used tokens to do this ...