Hello, Is it possible to use eventstats with conditions? For example: I only want to apply eventstats only if field name contains "student-1" | eventstats values(if(match(name,"student-1"), n...
Hello, I need help improve efficiency of my search using eventstats. The search worked just fine, but when I applied to large set of data, it took too long. Please suggest. Thank y...
I can't comprehend what 'eventstats' is. I went thru the splunk docs. I wanna use math functions like avg.. etc.. not sure whether to use stats avg or eventstats avg !! An example would be a...
...his but im getting 0 results
| stats count by SERVERS
| stats count(SERVERS) by Domain as "Domain_Count"
| eventstats sum(count) as Total_Servers
What can I do ? Thanks
...lank. (I probably need to also sort by host, but that's irrelevant to the eventstats issue.) index=iis status=404 uri="*/*.*"
|stats count by host uri
|eventstats max(count) by host as h...
...s:azure:accounts" source="rest*User*")
| where match(userPrincipalName,"domain name") or match(userPrincipalName,"domain name")
| eventstats count by id
| eventstats count(eval((source="rest://MSGraph G...
I have used below query to get distinct values:
stats values(gitRepo) AS serviceName BY buildNum
This gives correct values. Problem is I am not getting value for other fields. If I used eventstats...