Hello i am using the following search  host=XXX sourcetype=ZZZ http_status=500 OR http_status=502 "HighCostAPI" | stats count by http_status, _time, pzInsKey | fields http_status _time pzInsKey count | addcoltotals count I get the following results  Which is what we wanted originally, now the customer would like to have a count for the 500 errors and the 502 errors separately. I guess it wouldn't be necessary to split the http_status into 2 columns just as long as i can have a count for both.    ... View more

I have a search/dash board that will show data over the last 30 days, the search is as followed  index=server EventCode=5829 | stats count by ComputerName, Domain, Machine_SamAccountName, Machine_Operating_System this search will give me roughly 70~ events a month, the problem is now my customer would like to have the time stamp put on the table, (which is easy by putting just the "_time" field in there) my problem that I am running into is that it will give me 10,000 results now! I showed the customer this and they said it would be fine for me to show just the latest event in the last 30 days for each Machine_SamAccountName.    My question is how????  ... View more

Ill start off i am newer to splunk....    I am using the following search  index=server source="WinEvent" EventCode=1234 OR EventCode=5678 | eval locked_account_name=mvindex(Account_Name, 1) | eval account_that_unlokcedit=mvindex(Security_ID, 0) | transaction startswith="locked out" endswith="unlocked" | stats sum(duration) as duration by locked_account_name account_that_unlokcedit | eval min=duration/60 | eval min=round(min,2) | search account_that_unlokcedit=*APP1234* OR account_that_unlokcedit=*z_xxx* OR account_that_unlokcedit=*APP56789*   I need to chang the min column to minutes..... then i need to get the average of that column(minutes) and put the average in its own column   ... View more

Hello I am running the following search, which works as it should. What I am trying to build off of it is a way to add a timechart to the search to see daily usage over 2 weeks.    | `kva_tstats_switcher("tstats sum(RootObject.bc) as total_bytes from datamodel=indexed_event_counts_hourly where [| tstats count where index=* source=/p01/data/syslogs* by sourcetype | fields - count | rename sourcetype as RootObject.st| return 1000 RootObject.st] by RootObject.st")` | rename RootObject.* as * | sort 100 - total_bytes | eval total_bytes=round(total_bytes/1073741824,1) | rename total_bytes as total_gb | rename st as sourcetype | addcoltotals labelfield=Total label=Total_Sum | sort – Total ... View more