Could you please share the search.log information ... View more

We formatted your code so it was easier to see the three queries. However, they were identical. Please update to add the second query. ... View more

Hello, The most straight forward way to handle this would be to use the top command. A couple of things to note. You'll want to wildcard your sourcetype so that you do indeed pickup the wineventlog sourcetypes (i.e. sourcetype="wineventlog:*"). In addition, you'll want to wrap the OR condition on the Type fields in parenthesis as such (Type="Critique" OR Type="Avertissement") SPL... index="wineventlog" sourcetype="wineventlog:*" SourceName="" (Type="Critique" OR Type="Avertissement") | dedup _time SourceName | top limit=10 SourceName ... View more

@jip31 if one of the answers has helped you, please do not forget to accept the same to mark this question as answered! ... View more

@jip31 @jip31jip31 I have converted my comment to answer. If your issue is resolved please accept the answer to mark this question as answered! ... View more

specify which sourcenames you do not want in the initial search: index="*" sourcetype="wineventlog:*" EventCode=* Type="*" SourceName!="Microsoft-Windows-Sysmon" SourceName!="Microsoft-Windows-TaskScheduler" SourceName!="PowerShell" SourceName!="MacAFee Endpoint Security" | stats count by SourceName Type or to simplify it index="*" sourcetype="wineventlog:*" EventCode=* Type="*" NOT SourceName IN ("Microsoft-Windows-Sysmon" "Microsoft-Windows-TaskScheduler" "PowerShell" "MacAFee Endpoint Security") | stats count by SourceName Type ... View more

it"s almost perfect! for Sheduled tasks operational and scheduled tasks sysmon, i want a name, toto for the first, titi for the second and i want just erreur Critique for the 4 sourcetype i try but i dont reach.... thanks ... View more

@niketnilay I'm having trouble with the hidden panel in your example. As I read the Splunk docs, the depends attribute means that the token "$alwaysHideCSSPanel$" must be set in order to display the panel. Since the token is not set in your example the CSS panel should not appear on the dashboard, correct? I pasted the CSS panel into a dashboard, but when I click back on UI to see the dashboard the panel is always there. Even though I haven't used the element to set the $alwaysHideCSSPanel$ token. I feel like I'm missing something... I want to use your CSS to adjust column widths, but I can't get the CSS panel to be invisible. Thanks! ... View more

in fact i use this request: index="wineventlog" (sourcetype="wineventlog:application" SourceName=endpoint SourceName="McAfee Endpoint Security" EventCode=* Type=Erreur RecordNumber "Type=Erreur") OR (sourcetype="WinEventLog:Microsoft-Windows-TaskScheduler/Operational" RecordNumber SourceName="Microsoft-Windows-TaskScheduler" EventCode=* Type=Avertissement) OR (sourcetype="wineventlog:*" "Type=Critique" RecordNumber) OR (sourcetype="WinEventLog:Windows PowerShell" EventCode = 400 OR EventCode = 600 RecordNumber) | stats count by SourceName Type i just have a problem for the sourcetype "wineventlog" because his sourcename is variable so i would like to rename this sourcetype as "Windows Events" i trie with rename but it dont works! syntax problem? thanks ... View more

sorry i have a last question : where i put your code in "my" code YOUR CODE : First Chart -24h@h now QA index=_internal sourcetype=splunkd log_level=* component!="Metrics" | stats count by log_level | rename log_level as Type $tokTime.earliest$ $tokTime.latest$ 1 10 none none false progressbar true false true | eventstats sum(count) as Total | eval percent=round((count/Total)*100,1) | eval Type=Type."(count: ".count.", percent: ".percent.")" | fields - count Total pie 0.0001 all progressbar [0x1e93c6,0xf2b827,0xd6563c] MY CODE : 2.FO_Stopped_Services3.12.55. 5. 6. 7. -24h@h 8. now 9. QA 10. <panel> <table> <title>FO_Stopped_Services_Synthesis</title> <search ref="FO_Services_Count"></search> <option name="drilldown">row</option> <format type="color" field="count"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> </table> </panel> <panel> <chart> <title>FO_Stopped_Services_Chart</title> <search ref="FO_Chart_Services"></search> <option name="charting.drilldown">none</option> </chart> </panel> <panel> <table> <title>FO_Stopped_BIT_Service</title> <search ref="FO_Service_BITS"></search> <option name="count">10</option> <option name="drilldown">row</option> <option name="rowNumbers">false</option> </table> </panel> <panel> <table> <title>FO_Stopped_PC Services_Service</title> <search ref="FO_Service_PC Services"></search> <option name="count">10</option> <option name="drilldown">row</option> <option name="rowNumbers">false</option> </table> </panel> <panel> <table> <title>FO_Stopped_SCCM_Services</title> <search ref="FO_Service_SCCM"></search> <option name="count">10</option> <option name="drilldown">row</option> </table> </panel> ... View more