...his but im getting 0 results
| stats count by SERVERS
| stats count(SERVERS) by Domain as "Domain_Count"
| eventstats sum(count) as Total_Servers
What can I do ? Thanks
I can't comprehend what 'eventstats' is. I went thru the splunk docs. I wanna use math functions like avg.. etc.. not sure whether to use stats avg or eventstats avg !! An example would be a...
I have used below query to get distinct values:
stats values(gitRepo) AS serviceName BY buildNum
This gives correct values. Problem is I am not getting value for other fields. If I used eventstats...
...s:azure:accounts" source="rest*User*")
| where match(userPrincipalName,"domain name") or match(userPrincipalName,"domain name")
| eventstats count by id
| eventstats count(eval((source="rest://MSGraph G...
...bsp;
In order to overcome the JOIN/subsearch limit and maybe gain some efficiencies I tried using eventstats instead. The resultant query is below, and runs for over an hour with questionable r...
Hello,
I'm looking to use the eventstats function to count the amount of times the word Error occurs in my event.
Can anyone help as it doesn't appear to work ?
Hi all - I'm attempting to write a query using earliest/latest based off a date field in the event, not _time. I've tried a dozen things, and no matter what I try the earliest/latest fields are not s...
...ll churns. where in above i want only churned. please some one help me out.
sourcetype="Customer_Churn"
| stats sum(Total_Revenue) as rev by PLACEMENT
| eventstats sum(rev) as f...