Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

help on stats(sum)

$
0
0
hi I use the code below in order to count some events from 3 fields (LogName SourceName Type ) index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats count by LogName SourceName Type | rename LogName as EventViewer_Source | sort -count Now I want to sum the differents counts i have with the code above by LogName and by Type I do this but ..... Thanks index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats sum(count) as Total by LogName, Type

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>