I am trying to do a time chart of available indexes in my environment , I already tried below query with no luck
| tstats count where index=* by index _time
but i want results in the same f...
Dears,
We need your support to convert below search to tstats search.
(index=os_windows OR index=workstation*) tag=authentication user!=*$ action=success EventCode=4624 Logon_Type=10 O...
Hello, I have below TSTATS command which is checking the specifig index population with events per day: | tstats count WHERE (index=_internal AND sourcetype=splunkd) OR (index=B) by host,s...
...hat lookup file to exclude the files, the search results will exclude the whole host and affected files, not just the singular file I want excluded. My tstats search: | tstats values(S...
I hope I explain this well. I have the following tstats search:
| tstats max(_time) AS _time WHERE index=_internal sourcetype=splunkd source=*metrics.log by host
I also have a lookup t...
I am trying to run the following tstats search:
| tstats summariesonly=true estdc(Malware_Attacks.dest) as "infected_hosts" where "Malware_Attacks.action=allowed" from datamodel="Malware"."M...
Dear Experts,
Request you help to convert this below query into tstats query.
index=network_proxy category="Personal Network Storage and Backup" | eval Megabytes=(((bytes_out/1024)/1024))| s...
...oints to this field, set as IPv4, is the "IP" field utilized within the GEO IP settings) What works: 1. Datamodel "test": Acceleration is on, status 100% complete, and tstats c...
...But when i use the below commands it does not work. It seems tstats is not able to able to do the average calculation ? i have the same issue for other fields. How do i fix the issue or am i m...
Is it possible to do a conditional count using tstats?
I want to count specific event_type: (count if(event_type = 'xxxxx')) as num_of_x
Thanks in advance