HI sorry the exact request is : index="wineventlog" sourcetype="wineventlog:" SourceName="" Type="Critique" OR Type="Avertissement" | dedup host | stats count | rename count AS "Number of machines" | eventstats sum(count) as Total | eval percent=round((count/Total)*100,1) | eval host=host."(count: ".count.", percent: ".percent.")" | fields - count ... View more

no sorry... ... View more

ok thanks ... View more

thanks!!!!!!! ... View more

thank you very much ... View more

thanks a lot!!!!!! ... View more

thanks a lot ... View more

index="wineventlog" (sourcetype="wineventlog:application" SourceName=*endpoint* SourceName="McAfee Endpoint Security" EventCode=* Type=Erreur RecordNumber "Type=Erreur") OR (sourcetype="WinEventLog:Microsoft-Windows-TaskScheduler/Operational" RecordNumber SourceName="Microsoft-Windows-TaskScheduler" EventCode=* Type=Avertissement) OR (sourcetype="wineventlog:*" "Type=Critique" RecordNumber) OR (sourcetype="WinEventLog:Windows PowerShell" EventCode = 400 OR EventCode = 600 RecordNumber) | stats count by Type SourceName eval SourceName=case(match(SourceName,"^McAfee"),"McAfee", (Type=="Avertissement" AND match(sourcetype,"WinEventLog\:Microsoft-Windows-TaskScheduler\/Operational")),"Task Scheduler Operational", (match(sourcetype,"^WinEventLog\:Microsoft-Windows-TaskScheduler\/Operational")),"Task Scheduler Sysmon", (match(sourcetype,"^WinEventLog\:") AND Type=="Critique"), "Winevents", true(),"OTHERS") ... View more

hi it doesnt works this is my final code below and the error message : index="wineventlog" (sourcetype="wineventlog:application" SourceName=endpoint SourceName="McAfee Endpoint Security" EventCode=* Type=Erreur RecordNumber "Type=Erreur") OR (sourcetype="WinEventLog:Microsoft-Windows-TaskScheduler/Operational" RecordNumber SourceName="Microsoft-Windows-TaskScheduler" EventCode=* Type=Avertissement) OR (sourcetype="wineventlog:*" "Type=Critique" RecordNumber) OR (sourcetype="WinEventLog:Windows PowerShell" EventCode = 400 OR EventCode = 600 RecordNumber) | stats count by Type SourceName eval SourceName=case(match(SourceName,"^McAfee"),"McAfee", (Type=="Avertissement" AND match(sourcetype,"WinEventLog:Microsoft-Windows-TaskScheduler\/Operational")),"Task Scheduler Operational", (match(sourcetype,"^WinEventLog:Microsoft-Windows-TaskScheduler\/Operational")),"Task Scheduler Sysmon", (match(sourcetype,"^WinEventLog:") AND Type=="Critique"), "Winevents", true(),"OTHERS") Error: Error in 'stats' command: The argument 'SourceName=case(match(SourceName,^McAfee),McAfee, (Type==Avertissement AND match(sourcetype,WinEventLog:Microsoft-Windows-TaskScheduler\/Operational)),Task Scheduler Operational, (match(sourcetype,^WinEventLog:Microsoft-Windows-TaskScheduler\/Operational)),Task Scheduler Sysmon, (match(sourcetype,^WinEventLog:) AND Type==Critique), Winevents, true(),OTHERS)' is invalid ... View more

in fact i use this request: index="wineventlog" (sourcetype="wineventlog:application" SourceName=endpoint SourceName="McAfee Endpoint Security" EventCode=* Type=Erreur RecordNumber "Type=Erreur") OR (sourcetype="WinEventLog:Microsoft-Windows-TaskScheduler/Operational" RecordNumber SourceName="Microsoft-Windows-TaskScheduler" EventCode=* Type=Avertissement) OR (sourcetype="wineventlog:*" "Type=Critique" RecordNumber) OR (sourcetype="WinEventLog:Windows PowerShell" EventCode = 400 OR EventCode = 600 RecordNumber) | stats count by SourceName Type i just have a problem for the sourcetype "wineventlog" because his sourcename is variable so i would like to rename this sourcetype as "Windows Events" i trie with rename but it dont works! syntax problem? thanks ... View more

thanks BUT what i need is static field this my entire request : index="wineventlog" (sourcetype="wineventlog:application" SourceName=endpoint SourceName="McAfee Endpoint Security" EventCode=* Type=Erreur RecordNumber "Type=Erreur") OR (sourcetype="WinEventLog:Microsoft-Windows-TaskScheduler/Operational" RecordNumber EventCode=* Type=Avertissement) OR (sourcetype="WinEventLog:Microsoft-Windows-TaskScheduler/Operational" RecordNumber EventCode=* Type=) OR (sourcetype="wineventlog:" "Type=Critique" RecordNumber) | stats count by Type SourceName for the first part of the request i want "McAfee" instead "McAfee Endpoint" for the second i want "Task Scheduler Operational" for the third "Task Scheduler Sysmon" and for the last "WinEvents" so the idea is to rename sourcename or sourcetype or to add a new column with static fields but i dont know how to do could you help me please??? ... View more

Hello and thanks i succeed to do my fits pie chart 🙂 but there is Something very stranhe in my count report i have to 3 entrie : RCAgentMgr 11 SMS Agent Host 288 Service de transfert intelligent en arrière-plan 1418 But in the chart i havent the entrie "RCAgentMgr" and for the entrie Service de transfert intelligent i have the same number of events! do you have an idea please??? ... View more

i just have to find Microsoft-Windows-WER-SystemErrorReporting and EMET events in W10 A idea??? Thanks ... View more

Sorry but for m'y first chart it doesnt help me... ... View more

thanks it works! ... View more

hi no not to ingest directly i have to check the size file of CBS.log" in an SPL command on many machines if i see that this file is > to 1 GO i have to receive an email what do you thing about this code? source="C:\Windows\Logs\CBS.log" | eval esize=len(_raw) | stats sum(esize) by sourcetype or do i need File/Directory Information Input Add-on? Thanks ... View more

oh thanks! sorry i a m rouky and i didnt male any elearning so it s difficut for me i have a last question when we wrire an spl command how do we do to know the exact name of a field in the index we are obliged to display fils like this : index=_internal | stats values(*) AS * | transpose | table column | rename column AS Fieldnames thanks again ... View more

sorry i have forgotten "error" so index=main | followTail = 0 AND _TCP_ROUTING = "pnlogGroup"| "error" | table disabled time range 120 minute?? ... View more

so index=main | followTail = 0 AND _TCP_ROUTING = "pnlogGroup" | table disabled time range 120 minute?? ... View more